🔍 Read the full analysis: This Week In Security: Firewall Fixes, A Rented Banking Trojan, A Blank PDF And Stolen Tokens. What To Actually Do on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
This October 29 security roundup highlights Fortinet patches and an ongoing campaign targeting firewall credentials, alongside a rented Android banking trojan and a backdoor delivered through a blank PDF. It also covers a Microsoft Authenticator issue that has been fixed, scanner activity using fake AI identities, and the limits of relying only on CISA’s actively exploited vulnerability list.
A security roundup published October 29 highlights six developments affecting businesses and individual users, including Fortinet firewall updates, an ongoing campaign using stolen or weak credentials, and an Android banking trojan offered to criminals for rent. The reports also describe a backdoor hidden in a blank PDF, a fixed Microsoft Authenticator issue, automated scanning with fake AI-bot identities, and a critical vulnerability absent from the US government’s actively exploited list.
Fortinet released coordinated updates for FortiOS, FortiManager and FortiAnalyzer on October 22, including fixes rated critical and high severity. The company said it would publish the related public advisories on November 10. Separately, the FBI and US Secret Service warned on October 6 that a campaign dubbed FortiBleed remained active. Their advisory cites SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. That figure is attributed to the security firm, not an independently established government count in the supplied material.
CloudSEK reported on October 28 that an Android crime kit called MR ROBOT is rented to criminals. The kit can be used to create fake banking apps that steal one-time codes and forward calls without the victim’s knowledge, according to the company. Trellix, in a report dated October 26, traced a backdoor to a blank PDF disguised as a FedEx tax invoice; its account says the file’s execution depended on the recipient accepting a warning from the PDF reader.
Researchers at Enclave reported October 23 that another Android app could obtain work-account login tokens through a weakness involving Microsoft Authenticator. Microsoft has fixed the issue, identified as CVE-2026-80097. Cequence said October 28 that it tracked one scanner cycling through about 32 false AI-bot identities while requesting password files and cloud keys. Separately, CISA gave US federal agencies three days to address PHP2Shell, while VulnCheck reported 1,358 recorded attack attempts against the document tool Gotenberg in 30 days; Gotenberg was not listed in CISA’s Known Exploited Vulnerabilities catalog, according to the source roundup.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Risks Span Firewalls and Phones
The reports point to practical exposure across several common parts of digital life: internet-facing firewalls, mobile banking, workplace authentication, email attachments and document-processing software. They do not describe one coordinated incident. Together, however, they show how attackers can exploit weak or reused credentials, persuade someone to approve a warning, or take advantage of software flaws to gain access.
For organizations, the firewall findings make credential hygiene and timely patching urgent alongside vulnerability management. The roundup says attackers have used credentials taken from earlier breaches or weak passwords to create administrator accounts on Fortinet devices. A configuration backup can also hold sensitive account information: Hudson Rock reported 40,573 password-containing records across 1,703 configuration reports from 1,689 devices. The company cautioned that these are records, not confirmed active users; 7,437 local accounts were marked disabled.
For users, the banking trojan and PDF case underscore that a convincing app or invoice is not proof of legitimacy. For security teams, the gap between CISA’s list and reported attacks on Gotenberg is a reminder that a government catalog can help set priorities but may not cover every currently targeted product. The reports support checking exposure and evidence of exploitation, not treating every finding as proof that a particular organization has been compromised.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Apple iPad Air 11-inch (M2), 512GB, Wi-Fi, Space Gray
As an affiliate, we earn on qualifying purchases.
How This Week’s Reports Connect
The source article describes its selection as six stories chosen from a 30-story Hacker News digest published October 29. Its author says the summaries were checked against original advisories or research reports, while cautioning that many measurements come from security vendors that also sell protective services. Those vendor counts should be read with their stated scope and limits.
The FortiBleed campaign and Fortinet’s October 22 software updates are related to the same product ecosystem but are distinct developments. The FBI and Secret Service advisory attributes the campaign to reuse of previously exposed passwords, weak-password guessing and older password-storage practices; Fortinet has said FortiBleed is not a new Fortinet vulnerability. The company’s separate security updates address vulnerabilities in its products, with public details scheduled for November 10.
The roundup also contrasts two vulnerability-prioritization signals. CISA’s Known Exploited Vulnerabilities catalog prompted a three-day federal deadline for PHP2Shell, while VulnCheck reported 1,358 Gotenberg attack attempts in a 30-day period even though that issue was not on the catalog at the time described. The attempt count is a reported observation, not a measure of successful compromises, and the source gives no basis for directly comparing its scale with other incidents.
“AI tools can now help attackers “reverse-engineer patches and build working exploits in hours or days, rather than weeks”.”
— Fortinet, on the timing of exploit development
What the Reports Do Not Establish
The source material does not establish how many Fortinet devices remain vulnerable or compromised now, how many of the password records Hudson Rock counted are still usable, or how many organizations were affected by the PDF or banking-trojan activity. The reported device, account and attack-attempt figures come from named security firms and have different scopes; they should not be treated as interchangeable measures of harm.
Fortinet’s public advisories for the October 22 updates were scheduled for November 10, so the specific flaws, affected versions and remediation details were not yet available in the material provided. The roundup also does not give the number of MR ROBOT customers or victims, or evidence that every reported Gotenberg attempt succeeded. The scanner activity described by Cequence is one observed scanner, not a measure of all automated probing.
Patch Advisories and Exposure Checks
Fortinet’s next stated milestone is publication of the public advisories on November 10. Administrators should consult the company’s official notices for affected versions and fixes, and review whether internet-facing Fortinet systems use strong, unique credentials and multifactor authentication. Organizations should also check for unfamiliar administrator accounts and protect configuration backups that may contain credentials.
Security teams can review the Microsoft notice for CVE-2026-80097 and confirm that affected Authenticator installations are updated. The reports also support checking mobile-device controls and warning staff not to approve unexpected PDF prompts or install banking apps from untrusted sources. Teams using Gotenberg or other document-processing tools should assess their own exposure and monitoring rather than relying solely on whether a flaw appears on CISA’s list. The material does not specify further investigation results or a confirmed timetable for updates beyond Fortinet’s advisory date.
Key Questions
What is FortiBleed?
FortiBleed is the name used for a campaign targeting Fortinet firewalls with stolen or weak credentials, according to the source article’s account of an FBI and US Secret Service warning. Fortinet said the campaign was not a new Fortinet vulnerability.
What should Fortinet customers know about the October updates?
Fortinet released updates for FortiOS, FortiManager and FortiAnalyzer on October 22, including critical- and high-severity fixes. The company said public advisories would follow on November 10; affected versions and specific flaw details were not included in the supplied material.
How does the MR ROBOT Android crime kit work?
CloudSEK reported that the rented kit can help criminals build fake banking apps that steal one-time codes and secretly forward calls. The source does not state how many victims or operators have been identified.
Was the Microsoft Authenticator issue fixed?
Yes. The source says Microsoft fixed the reported Android issue, listed as CVE-2026-80097. Users and administrators should refer to Microsoft’s security information for applicable versions and update guidance.
Does a vulnerability’s absence from CISA’s list mean it is safe?
No. The roundup notes that Gotenberg was not on CISA’s Known Exploited Vulnerabilities list despite a VulnCheck report of 1,358 attack attempts over 30 days. That count does not establish successful compromises, but the example shows that teams should assess their own systems and other credible threat reporting as well.
Source: ThorstenMeyerAI.com
