🔍 Read the full analysis: AI Security Headlines, Decoded: What To Do About This Week’s Threats on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A ThorstenMeyerAI.com review published Oct. 29 selected six security stories from The Hacker News’ weekly digest and matched each with an action. The reports cover active Fortinet firewall attacks, Android banking malware and token theft, a malicious PDF, fake AI-bot identities, and gaps in the CISA vulnerability list; some figures come from security firms’ own research and have limits.
ThorstenMeyerAI.com published a six-story security review on Oct. 29, drawing from The Hacker News’ weekly digest and the original advisories and research reports. It highlights active attacks against Fortinet firewalls, Android malware targeting banking credentials and work tokens, a malicious PDF, fake AI-bot identities, and a gap in the US government’s vulnerability-prioritization list, with a recommended defensive action for each.
The most urgent item for organizations is the FortiBleed campaign. The FBI and US Secret Service said on Oct. 6 that the campaign remained active, with attackers using previously exposed or weak credentials to access Fortinet firewalls. The agencies cited SOCRadar’s count of more than 86,644 compromised devices across 194 countries. Those figures are attributed to the security firm, not an independently stated government tally.
Fortinet separately released security updates for FortiOS, FortiManager and FortiAnalyzer on Oct. 22, including critical- and high-severity fixes. The company said the public advisories would follow on Nov. 10. The review also cites Hudson Rock’s analysis of 1,703 configuration reports from 1,689 devices: it counted 40,573 records containing plain-text passwords, including 37,076 local user-account records. Hudson Rock cautioned that these were records rather than people, and that some accounts were disabled.
The other reports point to different ways credentials and access can be compromised. CloudSEK described MR ROBOT, an Android crime kit rented by criminals to create fake banking apps that steal one-time codes and forward calls. Enclave researchers reported that another Android app could obtain Microsoft Authenticator login tokens under particular conditions; Microsoft says it fixed the issue, tracked as CVE-2026-80097. Trellix traced a backdoor to a disguised, empty PDF that depended on a user accepting a warning. Cequence reported a scanner rotating through about 32 fake AI-bot identities while seeking password files and cloud keys. These are vendor and researcher findings, rather than a single government incident report.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Where Stolen Credentials Open Doors
The reports share a practical risk: attackers can turn reused passwords, stolen tokens and routine user approvals into access to business systems. A compromised firewall may expose a network’s boundary; an Authenticator token can give an app access to a work account; and a fake banking app can capture one-time codes that users may assume are sufficient protection.
The review’s recommended actions are concrete. Organizations should apply Fortinet’s available updates, check firewall accounts and configuration backups, replace exposed credentials, and require multifactor authentication where supported. Android users should install software only from trusted sources and treat unexpected login or document prompts cautiously. Security teams should not treat an AI-bot label or user-agent string as proof that a request is legitimate.
Prioritization also matters. CISA’s Known Exploited Vulnerabilities catalog helps federal agencies identify flaws that require action, but the review notes that a vulnerability absent from that list can still warrant attention. Vulnerability management needs to account for exposure, credible exploitation reporting and the systems an organization actually runs, not only one catalog.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
Six Reports Behind the Review
The article is a weekly news review, not a new incident disclosure. Its author says The Hacker News’ Oct. 29 digest contained 30 stories and selected six for business and consumer relevance, then checked the original advisory or research report for each. The six categories are firewall compromise and updates, Android banking malware, malicious PDF delivery, Authenticator token exposure, impersonation of AI bots, and vulnerability-list coverage.
Some details are time-sensitive. Fortinet’s Oct. 22 updates preceded public advisories scheduled for Nov. 10, according to the source material. The FBI and US Secret Service warning about FortiBleed was issued Oct. 6, while the cited CloudSEK, Trellix, Enclave, Cequence and Hudson Rock reports appeared later in October. The article also says CISA gave federal agencies three days to address PHP2Shell and cites VulnCheck’s report of 1,358 attack attempts against Gotenberg in 30 days; the source does not specify that Gotenberg is on CISA’s list.
Several numbers are research-company observations with defined limits. Hudson Rock counted records in configuration reports, not confirmed active accounts or distinct affected people. The Gotenberg attack-attempt count is attributed to VulnCheck and refers to a 30-day period. The review warns that security vendors both investigate threats and sell protective services, so their counts should be understood with that attribution.
Limits of the Reported Counts
The review does not provide independently verified totals for all six threats or establish how many readers or organizations have been affected. Vendor-reported counts vary in scope: compromised devices, configuration records and attack attempts are different measures and should not be compared as though they were the same thing.
Fortinet’s public advisories were scheduled for Nov. 10, so the precise technical details of the Oct. 22 fixes were not yet public in the source material. The account of the Authenticator issue says Microsoft fixed it but does not describe the affected app versions, deployment conditions or how many accounts were exposed. The review also does not say whether every fake banking app or malicious PDF attempt succeeded.
For Gotenberg, the cited 1,358 attempts cover a 30-day window, but the material does not identify how many were successful or how many systems were affected. It also does not establish that absence from CISA’s list means a flaw is safe to defer. Those questions require further advisories and organization-specific checks.
Patch and Recheck Exposed Systems
Organizations using Fortinet products should apply the available Oct. 22 updates and monitor Fortinet’s Nov. 10 advisories for the technical details. Security teams should review firewall administrator accounts, remove accounts that are not needed, replace reused or exposed passwords, enable multifactor authentication, and inspect configuration backups for sensitive credentials. The FBI and US Secret Service warning makes credential hygiene relevant even where teams have not identified a new product flaw.
IT teams should also check whether they run PHP or Gotenberg, consult current vendor and CISA guidance, and prioritize systems exposed to the internet or supported by credible exploitation reports. Consumers should update Android apps and operating systems, install banking apps through trusted distribution channels, and avoid accepting unexpected prompts that request permission or approval.
Further confirmation depends on the underlying vendors and researchers publishing technical details and updates. The immediate response is to verify exposure and apply available fixes, while treating reported counts as attributed findings rather than a complete measure of the threat.
Key Questions
What is the main development in this report?
ThorstenMeyerAI.com selected six security stories from The Hacker News’ Oct. 29 digest and summarized their reported risks and defensive actions. The review itself is not a new vulnerability disclosure.
What should Fortinet customers do now?
Apply the available updates for FortiOS, FortiManager and FortiAnalyzer, review firewall accounts and backups, change exposed or reused passwords, and use multifactor authentication. Fortinet’s detailed public advisories were scheduled for Nov. 10 in the source material.
Does the FortiBleed figure mean 86,644 confirmed victims?
No. The FBI and US Secret Service cited SOCRadar as verifying more than 86,644 compromised devices across 194 countries. That is an attributed device count, not a count of individual people or a separate government estimate.
Has Microsoft fixed the Authenticator issue?
The review says Microsoft fixed the reported Android issue, tracked as CVE-2026-80097. It does not provide affected-version details, so users and administrators should consult Microsoft’s current guidance and keep the app updated.
Does absence from CISA’s list mean a vulnerability is not urgent?
No. The review’s Gotenberg example says VulnCheck recorded 1,358 attack attempts in 30 days, while the flaw was not on the CISA list at the time described. Organizations should consider their own exposure and current vendor guidance; the reported attempts do not establish how many attacks succeeded.
Source: ThorstenMeyerAI.com
