🔍 Read the full analysis: AI Security In A Week Of Firewall Fixes And Stolen Tokens on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A roundup published October 29 highlights six security developments, including Fortinet updates and an FBI and Secret Service warning that a campaign targeting Fortinet firewall credentials remains active. Researchers also reported Android work-token exposure, rented Android banking malware, a backdoor delivered through a disguised PDF, AI-bot impersonation and gaps in CISA’s must-patch list. Several figures come from security companies’ own analyses and have limits the roundup identifies.
A security roundup published October 29 highlights two related risks for Fortinet customers: the company issued critical and high-severity updates for FortiOS, FortiManager and FortiAnalyzer, while the FBI and U.S. Secret Service said a campaign stealing access to Fortinet firewalls remained active. The roundup also describes reported Android token theft, fake banking apps, a PDF-delivered backdoor and automated requests made under false AI-bot identities.
Fortinet released coordinated security updates on October 22. The public advisories for the fixes are scheduled for November 10, according to the roundup, which says the company classified issues among the updates as critical or high severity. Fortinet said AI-assisted testing contributed to identifying issues and credited Anthropic, OpenAI, Google and SpaceX. The roundup does not provide vulnerability identifiers or technical details for the unreleased advisories.
Separately, the FBI and Secret Service warned on October 6 that the FortiBleed campaign was ongoing. The agencies cited security firm SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. The reported methods included reuse of previously leaked passwords, guessing weak passwords and cracking password files stored using a legacy method. The agencies named INC/Lynx and Payload as ransomware groups buying access, according to the roundup.
Other findings in the six-story selection came from security researchers and vendors. CloudSEK reported that an Android crime kit called MR ROBOT is rented to criminals for creating fake bank apps that can steal one-time codes and forward calls. Trellix said an empty PDF disguised as a FedEx tax invoice delivered a backdoor when a user accepted a PDF reader’s warning. Enclave researchers reported that another Android app could obtain Microsoft Authenticator work-account login tokens; Microsoft has since fixed the issue, listed as CVE-2026-80097.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Firewall Access Remains a Business Risk
The firewall reports point to two different security problems that organizations need to handle separately: new product fixes and exposure through compromised credentials. Installing updates addresses known software flaws, but it does not by itself invalidate passwords already stolen or remove unauthorized administrator accounts. The FBI and Secret Service warning makes that distinction especially relevant for organizations that rely on internet-facing network equipment.
The other stories show how account access can be targeted beyond the firewall. A stolen authenticator token may expose a work account, while a rented fake-banking-app kit can put one-time codes and calls at risk. These reports do not establish how widespread the activity is, but they illustrate why patching, credential reviews and cautious handling of unexpected files all matter.
The roundup also warns against treating one official list as a complete risk register. It says CISA gave federal agencies three days to address PHP2Shell, while a critical Gotenberg flaw was absent from the agency’s Known Exploited Vulnerabilities catalog despite VulnCheck reporting 1,358 attack attempts in 30 days. That attempt count is VulnCheck’s figure; the source does not provide a comparison baseline or establish that every attempt succeeded.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Sonos Era 100 SL Compact, Microphone-Free Speaker – Black
As an affiliate, we earn on qualifying purchases.
Six Reports, Several Different Threats
The article is a selection from The Hacker News’ October 29 weekly digest, which contained 30 stories. Thorsten Meyer says the six chosen items were checked against original advisories or research reports. The roundup also cautions that many figures come from the security companies that discovered or investigated the activity, firms that also sell security services.
For FortiBleed, Hudson Rock published a separate analysis on October 27 of 1,703 configuration reports from 1,689 devices. It counted 40,573 records containing passwords in plain text, including local-user and Active Directory connection-account records. Hudson Rock stressed that these were records, not necessarily distinct people or usable credentials; 7,437 local accounts were marked disabled. Fortinet has said FortiBleed is not a new Fortinet vulnerability and attributed the activity to reused credentials and password guessing, particularly where passwords are weak and multifactor authentication is absent.
The roundup’s remaining reports broaden the picture without tying the incidents to one actor or campaign. Cequence said it tracked a scanner rotating through about 32 fake AI-bot identities while requesting password files and cloud keys. These are vendor-reported observations, not proof that a particular AI company or bot service conducted the activity. The roundup presents the incidents as separate stories, not as evidence of a coordinated operation.
“FortiBleed “is not a new Fortinet vulnerability.””
— Fortinet
Advisory Details Are Still Pending
The public technical details for Fortinet’s October 22 updates are not due until November 10, based on the roundup. Until those advisories appear, the vulnerabilities’ identifiers, affected versions, exploitation status and recommended upgrade paths are not specified in the supplied material. It is also not clear how many organizations installed the updates before the advisories were scheduled to become public.
The FortiBleed figures have different scopes: SOCRadar’s device count and Hudson Rock’s configuration-record analysis should not be treated as interchangeable measures of active victims. Hudson Rock said some accounts were disabled, and the source does not establish how many credentials remain valid or how many devices are still exposed. Fortinet disputes framing the campaign as a new product vulnerability and points instead to credential weaknesses.
For the Android, PDF and AI-identity reports, the supplied material does not give complete victim counts, confirmed financial losses or independent validation of each vendor’s observations. It also does not say whether the Gotenberg attack-attempt figure represents distinct targets or successful compromises. Those details remain unconfirmed here.
Apply Fixes and Review Access
Fortinet customers should consult the company’s available update guidance for their products, apply relevant fixes, and review firewall administrator accounts and credentials. The roundup recommends treating the updates as a priority change, while the agencies’ warning makes checking for unauthorized accounts and replacing exposed or reused passwords a separate task. Organizations should also use multifactor authentication where available.
The scheduled November 10 Fortinet advisories should supply the technical information missing from the current account. Security teams can then confirm affected versions and verify that their deployments are covered. The roundup also advises teams to prioritize CISA-listed vulnerabilities while checking other credible advisories and threat reports rather than assuming the catalog includes every flaw being targeted.
For individuals and workplace users, the practical steps are to avoid accepting unexpected file-reader prompts, install app and operating-system updates, and report suspicious banking apps or authentication requests. Microsoft has fixed the Authenticator issue described in the roundup, but readers should consult Microsoft’s current guidance to determine whether their devices and app versions need action.
Key Questions
What is the main security development in this roundup?
The leading development is that Fortinet issued critical and high-severity updates while U.S. agencies said a separate campaign targeting Fortinet firewall credentials remained active.
Does FortiBleed involve a newly discovered Fortinet vulnerability?
Fortinet said FortiBleed is not a new Fortinet vulnerability. The company attributed the campaign to credential reuse and password guessing; the FBI and Secret Service warning described continued activity against Fortinet firewalls.
When will Fortinet publish more details about the October updates?
The roundup says Fortinet scheduled the public advisories for November 10, 2026. The supplied material does not list the vulnerabilities or affected versions.
Was Microsoft Authenticator’s Android token issue fixed?
Yes. The roundup says Microsoft fixed the issue reported by researchers and identifies it as CVE-2026-80097. It does not provide further update instructions or affected-version details.
Are the reported attack and exposure figures confirmed totals?
They are figures reported by the named researchers and security companies, not a single verified count of victims. For example, Hudson Rock counted configuration records, including disabled accounts, and said records do not equal people or necessarily usable credentials.
Source: ThorstenMeyerAI.com
