🔍 Read the full analysis: This Week’s Security Stories Through An AI Lens: What To Actually Do on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A security roundup published October 29 highlights six developments affecting company networks, phones, inboxes and vulnerability management. Its recommended actions include updating Fortinet products, reviewing firewall credentials and backups, and treating requests for permissions or sensitive files with caution.
ThorstenMeyerAI.com published a six-story security roundup on October 29, drawing from The Hacker News’ 30-item weekly digest and pointing readers to practical steps for businesses and everyday users. The selection covers active attacks involving Fortinet firewalls, Android banking malware, a malicious PDF, an Android authentication issue, automated credential scanning and vulnerability prioritization.
The roundup’s most urgent enterprise item concerns Fortinet firewalls. The FBI and U.S. Secret Service warned on October 6 that a campaign dubbed “FortiBleed” remained active, while Fortinet issued security updates for FortiOS, FortiManager and FortiAnalyzer on October 22. The company said the releases include critical and high-severity fixes and urged customers to prioritize them. Public advisories are scheduled for November 10.
The article attributes campaign figures to outside security companies. It says the FBI and Secret Service cited SOCRadar, which reported verifying more than 86,644 compromised devices in 194 countries. Hudson Rock separately analyzed 1,703 firewall configuration reports from 1,689 devices and counted 40,573 password-containing records. Those are records, not a count of affected people or necessarily active accounts; Hudson Rock said 7,437 local accounts were marked disabled. Fortinet said the campaign did not rely on a new Fortinet vulnerability, but on reused or weak credentials and missing multifactor authentication.
Other items include CloudSEK’s report on MR ROBOT, a rented Android crime kit used to make fake banking apps that can steal one-time codes and forward calls; Trellix’s account of a backdoor delivered through an empty PDF disguised as a FedEx tax invoice; and researchers’ report that an Android issue could expose Microsoft Authenticator work-account login tokens to another app. Microsoft has fixed that issue, identified as CVE-2026-80097. Cequence also reported a scanner rotating through about 32 fake AI-bot identities while seeking password files and cloud keys. Finally, the roundup compares CISA’s required federal response to PHP2Shell with VulnCheck’s report of 1,358 Gotenberg attack attempts in 30 days; Gotenberg was not on CISA’s Known Exploited Vulnerabilities catalog at the time described.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Practical Steps for Networks and Phones
The six stories point to several ways attackers can gain access without relying on a novel technique: reused passwords, weak account security, deceptive files, and software trust. For organizations, compromised firewall credentials can expose a network’s perimeter and give intruders a foothold. For individuals, a counterfeit banking app or a misleading PDF can turn a routine interaction into a route for stealing credentials or installing malware.
The roundup’s practical value is its focus on actions rather than a list of headlines. Businesses can prioritize Fortinet updates, check whether firewall administrator and directory credentials are protected by multifactor authentication, and review configuration backups as sensitive data. Users can avoid installing banking apps from links in messages, verify that an app comes from an official store and publisher, and stop if a document reader displays a security warning they do not understand.
It also warns against treating any single vulnerability list as a complete measure of risk. CISA’s catalog identifies vulnerabilities that meet its criteria for federal remediation, but the roundup notes that reported attacks against Gotenberg were not reflected there. Security teams may need to combine official catalogs with vendor advisories, threat intelligence and evidence about the software they actually run.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Dell UltraSharp U2725QE 27-Inch 4K UHD IPS Black Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Six Stories Were Selected
The source article says The Hacker News published a 30-story security digest on October 29. Thorsten Meyer selected six developments judged relevant to businesses and ordinary users, then consulted original advisories or research reports. It also cautions that many of the figures come from security companies that discovered the activity and sell security products; company-reported counts are attributed rather than presented as independent measurements.
In the Fortinet case, the source distinguishes an ongoing campaign using credentials from the separate release of product security updates. Fortinet’s June 19 statement, as cited by the roundup, attributed the campaign to previously exposed or weak passwords and a lack of second-factor protection. The company’s October updates addressed critical and high-severity issues in several products. The article says Fortinet credited AI-assisted testing with helping find some of the flaws and warned that attackers could study patches and develop exploits faster.
“A firewall backup is the building’s master key ring and the staff list in one envelope.”
— Thorsten Meyer, source article
Limits of the Reported Counts
The figures in the roundup come from different researchers, samples and measurement methods, so they should not be treated as one unified estimate of victims. Hudson Rock counted password-containing records in configuration reports, not confirmed active users; some accounts were disabled. The article does not establish how many records remain usable or how many organizations were affected.
Details of Fortinet’s October fixes were not public in the source material; the company scheduled its advisories for November 10. The precise scope and impact of those flaws therefore remain unclear here. The roundup also does not provide independently verified counts for the Android malware’s victims, the malicious PDF campaign, or the activity attributed to the scanner using fake AI-bot identities.
The source summarizes a claim that Microsoft fixed the Authenticator issue, but gives limited technical detail about which configurations or users were exposed. Its description of Gotenberg attack attempts likewise does not confirm how many succeeded. These distinctions matter: reported attempts, exposed records and successful compromises are not interchangeable.
Updates and Checks to Follow
Fortinet’s public advisories scheduled for November 10 should provide the product-level details needed to identify affected versions and apply the relevant fixes. Administrators should consult the vendor’s advisories and their own asset inventories rather than infer exposure from the roundup alone. They should also review firewall accounts, remove or disable accounts no longer needed, rotate potentially exposed credentials and use multifactor authentication where available.
Organizations can review whether firewall configuration backups and diagnostic reports contain credentials, restrict access to those files, and investigate whether any listed accounts or devices show signs of unauthorized access. Security teams should check the status of Microsoft Authenticator on Android and apply Microsoft’s fix, while following vendor guidance for any affected systems.
For the other reports, users should install banking apps through trusted channels and take warnings from PDF readers seriously. IT teams should check whether they use Gotenberg or other software mentioned in advisories, then weigh vendor notices and credible reports of exploitation alongside CISA’s catalog. The source does not identify a single follow-up date for the other cases, so their status may change as researchers and vendors publish more information.
Key Questions
What is the main development in this security roundup?
ThorstenMeyerAI.com selected six security stories from a 30-item Hacker News digest published October 29 and paired them with suggested actions for organizations and users.
What should Fortinet customers do?
Check Fortinet’s product advisories and apply relevant updates. Review firewall accounts and configuration files, rotate credentials that may be exposed, and use multifactor authentication for administrative access. The source says public details of the October fixes were scheduled for November 10.
Does the FortiBleed report mean every listed account is compromised?
No. Hudson Rock counted password-containing records in analyzed firewall configuration reports, not confirmed active users or successful logins. It said 7,437 local accounts were marked disabled, and the source does not establish how many records remain usable.
What does the Android Authenticator story mean for users?
Researchers reported that an Android issue could allow another app to obtain work-account login tokens from Microsoft Authenticator. The source says Microsoft has fixed the issue; users and administrators should follow Microsoft’s update guidance and check affected devices.
Is CISA’s vulnerability catalog a complete list of risks?
Not necessarily. The roundup says CISA required federal agencies to address PHP2Shell, while VulnCheck reported 1,358 Gotenberg attack attempts in 30 days and Gotenberg was not on the catalog. Teams should use vendor advisories and relevant threat reports as well as official lists.
Source: ThorstenMeyerAI.com
