🔍 Read the full analysis: A Practical Checklist For AI Security After This Week’s News on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A weekly security roundup published October 29 identifies six risks involving firewalls, Android banking malware, a malicious PDF, authentication tokens, fake AI-bot identities and vulnerability prioritization. The reported fixes and precautions include updating affected software, securing credentials and treating official patch lists as a starting point—not a complete inventory of risk.
ThorstenMeyerAI.com published a six-story security roundup on October 29, turning developments reported by security researchers and government agencies into practical steps for businesses and ordinary users. The account highlights active attacks against Fortinet firewalls, Android banking malware and other threats, while stressing that several statistics come from security firms that sell protective services.
The roundup says Fortinet released critical and high-severity updates for FortiOS, FortiManager and FortiAnalyzer on October 22, and describes the company’s request to prioritize the changes. Public details about the advisories are scheduled for November 10. Separately, the FBI and U.S. Secret Service warned that a campaign dubbed FortiBleed remains active. The agencies cited SOCRadar’s report of more than 86,644 compromised devices across 194 countries; that figure is the security firm’s count, not an independently verified government total in the material provided.
Other items include CloudSEK’s report on MR ROBOT, an Android crime kit rented by criminals to make fake banking apps that steal one-time codes and forward calls; and Trellix’s account of a backdoor delivered through a blank PDF disguised as a FedEx tax invoice. Trellix said the PDF only worked after a user accepted the reader’s warning. Researchers also reported that a flaw in Microsoft Authenticator on Android could expose work-account login tokens to another app. Microsoft has fixed that issue, identified as CVE-2026-80097.
The final two items concern automated scanning and patch priorities. Cequence reported tracking a scanner that cycled through about 32 fake AI-bot identities while requesting password files and cloud keys. VulnCheck reported 1,358 attack attempts against a critical Gotenberg flaw over 30 days, while the article says the vulnerability is absent from CISA’s Known Exploited Vulnerabilities catalog. CISA separately gave U.S. federal agencies three days to address PHP2Shell.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Where Security Teams Should Act First
The reports point to familiar weaknesses across several parts of daily digital life: exposed network equipment, reused or weak passwords, risky prompts and misplaced trust in software identity. For companies, a compromised firewall can provide an entry point into wider systems, while stolen authentication tokens can put workplace accounts at risk. For individuals, fake banking apps can target account credentials and one-time codes.
The roundup’s practical value is in connecting each report to a defensive response. Organizations should prioritize vendor updates, review firewall access and stored configuration data, and verify that multi-factor authentication is enabled. Users should avoid installing banking apps from links in messages and should not approve unexpected security prompts. These steps do not establish that every reader is exposed; they address the types of weaknesses described in the reports.
The Gotenberg example also illustrates a limits-of-the-list problem. CISA’s KEV catalog is a useful prioritization tool, but the roundup argues that a flaw’s absence from the catalog should not be treated as proof that it is harmless. Teams still need to monitor vendor notices, credible research and their own exposure.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
As an affiliate, we earn on qualifying purchases.
Six Reports Behind the Checklist
The article is a selection from a larger weekly digest: it says The Hacker News published 30 security stories on October 29, then selects six it considers relevant to businesses and ordinary users. It says the writer went back to original advisories or research reports, though many of the figures remain attributed to the companies that produced them.
For FortiBleed, the roundup distinguishes the reported campaign from a newly disclosed Fortinet software vulnerability. Fortinet’s position, as quoted in the source, is that the campaign is not based on a new Fortinet vulnerability, but on credentials reused from previous incidents and weak passwords, including devices without a second factor. The source also describes Hudson Rock’s separate analysis of 1,703 configuration reports from 1,689 devices, which counted 40,573 password-containing records. Those are records, not a count of affected people or necessarily active accounts; the report says 7,437 local accounts were marked disabled.
For the authenticator issue, the source says Microsoft has issued a fix. For the Fortinet updates, it says public advisories will follow on November 10. Those different timelines matter: a patch may be available before all technical details are public, while a reported issue may already have a vendor fix.
““None of this week’s attacks needed magic.””
— Thorsten Meyer, the roundup’s author
What the Reports Do Not Establish
The source does not independently verify the reported counts of compromised devices, exposed password records, scanner identities or attack attempts. Several figures come from security vendors, and the article itself notes that those companies also sell security products. The figures should be read with their stated scope: for example, 1,358 Gotenberg attempts over 30 days is a reported attempt count, not a count of successful compromises.
It is also unclear from the supplied material how many Fortinet devices remain exposed, how many listed credentials still work, or whether the reported attacks affected a particular organization. The full technical details of the October 22 Fortinet updates are not yet public in the account, with advisories scheduled for November 10. The material does not provide equivalent technical detail or remediation instructions for every story.
Patch, Verify and Recheck
Organizations using FortiOS, FortiManager or FortiAnalyzer should review Fortinet’s update guidance and prioritize the October 22 releases according to their exposure and change procedures. They should also check firewall administrator access, replace reused credentials, enable multi-factor authentication where available, and treat exported configuration files as sensitive. Further technical detail is expected when the public advisories appear on November 10.
Security teams should confirm that Microsoft Authenticator on Android is updated, review vendor notices for affected systems and assess Gotenberg exposure even though the source says it is not listed in CISA’s KEV catalog. Individuals should install banking apps through trusted app stores, avoid approving unexpected prompts and report suspicious messages. The practical checklist is a starting point; the source material does not establish that these actions alone address every vulnerability or incident described.
Key Questions
What is the main news in this report?
ThorstenMeyerAI.com selected six security developments from the week and translated them into suggested defensive actions for businesses and individual users.
What should Fortinet customers do?
Review and prioritize Fortinet’s October 22 updates for FortiOS, FortiManager and FortiAnalyzer. Check administrator accounts and credentials as well; Fortinet says the FortiBleed campaign uses reused or weak passwords rather than a new product vulnerability.
Has Microsoft fixed the Authenticator issue?
The source says Microsoft has fixed the Android issue identified as CVE-2026-80097. Users and organizations should confirm they have the updated app.
Does a flaw’s absence from CISA’s KEV list mean it is safe?
No. The roundup says the reported Gotenberg flaw is not on the catalog despite VulnCheck reporting 1,358 attack attempts in 30 days. That reported attempt count does not establish how many attacks succeeded.
Source: ThorstenMeyerAI.com
