🔍 Read the full analysis: AI And Cybersecurity This Week: Key Stories And What To Do on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A roundup published October 29 highlights six cybersecurity developments, including ongoing attacks on Fortinet firewalls, Android malware targeting bank logins and a malicious PDF used to deliver a backdoor. The reports point to practical steps such as updating software, securing accounts with multifactor authentication and treating suspicious documents with caution.
A cybersecurity roundup published October 29 highlights six developments affecting businesses and ordinary users, from an active campaign targeting Fortinet firewalls to Android malware built to steal banking credentials. The report, by Thorsten Meyer, draws on advisories and research from security companies and government agencies, and pairs each story with a suggested defensive step.
The roundup says the FBI and the U.S. Secret Service warned on October 6 that the FortiBleed campaign against Fortinet firewalls remained active. The agencies cited SOCRadar, which reported verifying more than 86,644 compromised devices in 194 countries. That figure is attributed to the security firm, rather than presented as an independently confirmed government count. The report says attackers use credentials exposed in earlier incidents, weak passwords and password files stored using a legacy method to gain access and create administrator accounts.
Fortinet also released security updates on October 22 for FortiOS, FortiManager and FortiAnalyzer, with critical- and high-severity fixes. The roundup says public advisories for those updates are scheduled for November 10. Separately, CloudSEK reported on October 28 that an Android crime kit called MR ROBOT is rented by criminals to create fake banking apps. The apps can steal one-time codes and secretly forward calls, according to the research firm.
Other items include Trellix’s report of a backdoor hidden in an empty PDF posing as a FedEx tax invoice; Enclave’s report that a flaw could expose work-account login tokens from Microsoft Authenticator on Android, which Microsoft has fixed; and Cequence’s account of an automated scanner presenting itself as dozens of fake AI bots while seeking sensitive files and cloud keys. The roundup also contrasts a CISA deadline for federal agencies to patch PHP2Shell with a separate Gotenberg flaw that VulnCheck said faced 1,358 recorded attack attempts in 30 days.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Risks Across Firewalls and Phones
The reports describe different entry points, but the consequences can reach beyond a single device. A compromised firewall can give intruders access to a company’s network; stolen banking codes can help criminals take over accounts; and exposed work login tokens can put business systems at risk. The firewall reporting also shows why a patch alone may not address every incident: the FortiBleed activity described in the roundup relies on weak or previously exposed credentials, according to Fortinet and the cited agencies.
For security teams, the developments are a reminder that official patch lists are not a complete inventory of risk. The roundup points to a Gotenberg flaw with reported attack attempts that was not on CISA’s Known Exploited Vulnerabilities catalog at the time described. That does not establish that every organization is exposed, but it supports checking software in use and relevant vendor advisories, rather than treating one list as the sole guide.
Products Worth Considering
Therabody Theragun Mini 3rd Generation Massage Gun, Black
Levoit Eleva 300X HEPA Air Purifier for Home and Bedroom
Philips Sonicare DiamondClean Smart 9300 Electric Toothbrush, Black
As an affiliate, we earn on qualifying purchases.
The Reports Behind Six Stories
The article says it selected six items from The Hacker News’ October 29 weekly digest, which contained 30 stories, and reviewed original advisories or research reports where available. Its sources include Fortinet, the FBI and U.S. Secret Service, CloudSEK, Trellix, Enclave, Microsoft, Cequence, CISA, VulnCheck and Hudson Rock. Several of the figures are counts published by private security companies. The article flags that those firms sell security services, a relevant limitation when reading vendor-reported data.
One example is Hudson Rock’s October 27 analysis of 1,703 firewall configuration reports from 1,689 devices. It counted 40,573 records containing passwords in plain text, including local accounts and Active Directory connection records. Hudson Rock cautioned that these were records, not necessarily active users or usable credentials; 7,437 local accounts were marked disabled. Fortinet has said FortiBleed is not a new Fortinet vulnerability, attributing the campaign to reused credentials and password guessing against weakly protected devices.
“FortiBleed “is not a new Fortinet vulnerability.””
— Fortinet
What the Reports Cannot Establish
The roundup does not independently verify all company-reported counts, and the numbers do not necessarily represent unique people, active accounts or successful compromises. Hudson Rock explicitly cautioned that its password-bearing records included disabled accounts. The cited material also does not establish how many organizations were affected by the Android malware, PDF backdoor, Authenticator flaw or AI-identity scanner.
Fortinet’s public advisories for the October 22 updates were due November 10, so the roundup does not provide the underlying vulnerability details or a complete account of affected versions. The supplied material does not include the full six original advisories or all recommended actions. It also does not say whether the reported Gotenberg attack attempts resulted in successful compromises.
Patch, Verify and Monitor
Organizations using Fortinet products should review Fortinet’s updates and apply relevant fixes, while checking firewall credentials, removing unnecessary accounts and enabling multifactor authentication where available. The FBI and Secret Service warning, as summarized in the roundup, makes credential hygiene especially relevant: updating software does not undo exposure from reused or weak passwords. Teams should also review which internet-facing systems they operate and check vendor guidance for PHP2Shell and Gotenberg where applicable.
Individuals can reduce exposure by installing operating-system and app updates, using unique passwords and multifactor authentication, and avoiding unexpected attachments or prompts to approve access. The roundup’s remaining developments to watch include Fortinet’s November 10 public advisories and further information from the researchers and agencies about the scope and impact of the reported campaigns. Those details were not available in the source material as of October 29.
Key Questions
What is the main development in this roundup?
It selects six cybersecurity reports and advisories published or updated during the week, including active attacks involving Fortinet firewalls, Android banking malware and a malicious PDF.
Are Fortinet customers affected by a newly disclosed FortiBleed flaw?
Fortinet said FortiBleed is not a new Fortinet vulnerability. The campaign described in the roundup involves reused or weak credentials. Fortinet separately issued security updates for FortiOS, FortiManager and FortiAnalyzer on October 22.
What does the MR ROBOT Android kit do?
CloudSEK reported that criminals can rent the kit to create fake banking apps designed to steal one-time codes and secretly forward calls. The supplied report does not give a confirmed count of victims.
What should organizations do now?
Review vendor advisories and install applicable updates. For firewall security, also check for weak or reused credentials, remove unneeded accounts and use multifactor authentication. Check relevant systems for exposure to the other reported flaws.
Are the reported attack counts confirmed totals?
No. Several figures come from private security firms and retain their reported scope and limitations. For example, Hudson Rock counted configuration records, not necessarily active users, while VulnCheck’s 1,358 Gotenberg figure refers to recorded attack attempts over 30 days, not confirmed successful intrusions.
Source: ThorstenMeyerAI.com
