🔍 Read the full analysis: How To Protect AI Workflows Amid This Week’s Security Headlines on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A security roundup published October 29 highlights six developments affecting businesses and individual users, including an active campaign against Fortinet firewalls, Android banking malware and a backdoor delivered through a disguised PDF. The reports point to practical safeguards, but some incident counts come from security vendors, and details on Fortinet’s latest fixes remain private until November 10.
A security roundup published October 29 highlights six recent developments for businesses and ordinary users, including an active campaign targeting Fortinet firewalls, Android malware that steals banking codes, and a backdoor hidden in a fake invoice PDF. The reports point to risks for corporate logins, phones and software-update decisions; Fortinet says details of its latest security advisories will remain private until November 10.
The roundup draws on advisories and research from government agencies and cybersecurity companies. The FBI and U.S. Secret Service said the FortiBleed campaign against Fortinet devices remained active in an October 6 warning. They cited SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. That figure is a security firm’s reported count, not an independently established tally in the supplied material. The reported method relies on stolen or weak passwords, rather than a newly disclosed Fortinet vulnerability, and can lead to attackers creating administrator accounts.
Fortinet separately released security updates on October 22 for FortiOS, FortiManager and FortiAnalyzer, with fixes described as critical or high severity. The company said public advisories would follow November 10. Another vendor report, from CloudSEK on October 28, described MR ROBOT, a rented Android crime kit used to create fake banking apps that can steal one-time codes and secretly forward calls. Trellix reported October 26 that an empty PDF disguised as a FedEx tax invoice delivered a backdoor when a user accepted a PDF reader warning.
Other reports covered an Android issue in Microsoft Authenticator that researchers said could expose work-account login tokens to another app; Microsoft has issued a fix, identified as CVE-2026-80097. Cequence reported a scanner cycling through about 32 false AI-bot identities while seeking password files and cloud keys. Separately, CISA’s Known Exploited Vulnerabilities catalog includes PHP2Shell, while VulnCheck reported 1,358 attack attempts against a critical Gotenberg flaw over 30 days; Gotenberg was not on that CISA list, according to the roundup.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Where AI Workflows Face Exposure
The six stories matter because AI workflows depend on the same infrastructure and trust signals targeted in these reports: network gateways, identity apps, email attachments and cloud credentials. A compromised firewall can expose access to a wider company network. A stolen authentication token can let an attacker act through a legitimate work account, while a fake AI-bot identity can be used to disguise automated attempts to obtain secrets.
The reports do not establish that AI itself caused every incident. Instead, they show why teams deploying AI tools need to protect the systems those tools use and the credentials they can reach. Security teams should review internet-facing devices, apply available patches, use multifactor authentication and limit access to tokens and secrets. For users, the PDF example is a reminder that a familiar delivery-company label does not make an attachment safe, particularly when software displays a warning.
Patch decisions also cannot rest on one list alone. CISA’s catalog identifies vulnerabilities known to be exploited, but the reported Gotenberg activity shows that security teams may need to weigh vendor and researcher alerts alongside government listings. That does not make every vendor-reported count conclusive; it means teams should check the underlying advisory, exposure and available mitigation rather than treating absence from a catalog as proof of safety.
Products Worth Considering
Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Logitech MX Brio Ultra HD 4K Webcam, Graphite
As an affiliate, we earn on qualifying purchases.
The Reports Behind This Week’s Risks
The source article says The Hacker News published a digest of 30 stories on October 29 and selects six for this report. Its author says the summaries were checked against original advisories or research reports. The supplied material also cautions that many figures come from the security companies that discovered the issues; those firms have relevant expertise but also sell security products. Counts attributed to those companies should be read with that provenance in mind.
The FortiBleed warning and Fortinet’s October security updates are related to firewall security but describe different matters. The campaign described by the FBI and Secret Service uses credentials that attackers obtained or guessed; Fortinet said it was not a new Fortinet vulnerability. The company’s October 22 releases address separate critical and high-severity flaws. Fortinet said the coordinated updates followed earlier releases for FortiMail and FortiAuthenticator, and that AI-assisted testing contributed to finding issues.
“FortiBleed is “not a new Fortinet vulnerability.””
— Fortinet
Counts, Exposure and Fix Details
The supplied reports do not establish how many devices remain exposed to FortiBleed or how many reported credentials are still usable. Hudson Rock’s October 27 analysis counted 40,573 password-containing records in 1,703 firewall configuration reports from 1,689 devices, but it stressed that records are not people and that some local accounts were disabled. The source says 7,437 local accounts were marked disabled; it does not establish that the remaining accounts are active or exploitable.
Fortinet’s public advisories for the October 22 releases are scheduled for November 10, so the supplied material does not identify the affected versions or provide a full account of each flaw. It also does not give independent validation of the vendor-reported Android, PDF, scanner or Gotenberg figures. For Gotenberg, the reported 1,358 attempts cover a 30-day period, but the material does not specify how many succeeded. It remains unclear which organizations were affected across these incidents and whether any reported attempts resulted in confirmed breaches.
Patch and Verify Before Advisories
Organizations using Fortinet products should follow Fortinet’s security guidance and apply relevant updates through their normal change process, while reviewing firewall accounts for weak or reused passwords, unexpected administrators and access that no longer needs to exist. The FBI and Secret Service warning makes credential review especially relevant: patching separate software flaws alone would not address the password-based FortiBleed activity described by the agencies.
Teams should also check whether Microsoft Authenticator on Android is updated, review safeguards for PDF attachments, and limit access to work tokens and cloud keys. Security staff can compare CISA’s KEV catalog with vendor advisories and reports such as VulnCheck’s Gotenberg findings, then prioritize systems according to exposure and available fixes. Fortinet’s scheduled November 10 advisories should provide more public detail about its October updates. The supplied sources do not state a further deadline or confirm a single fix that covers all six developments.
Key Questions
What is the main confirmed development in this roundup?
A report published October 29 brings together six security developments, including a government warning that a campaign targeting Fortinet firewalls remained active, plus reports on Android malware, a malicious PDF, an Authenticator issue, AI-bot impersonation and vulnerability prioritization.
Does FortiBleed refer to a newly disclosed Fortinet flaw?
Fortinet said FortiBleed is not a new Fortinet vulnerability. The FBI and U.S. Secret Service warning describes attackers using stolen or weak passwords to gain access to devices.
What should Fortinet customers do now?
Follow Fortinet’s security guidance, install applicable security updates and review administrator accounts and password practices. Fortinet’s public advisories for its October 22 updates are scheduled for November 10, according to the source material.
Has the Microsoft Authenticator issue been fixed?
The roundup says Microsoft has issued a fix for the Android issue, identified as CVE-2026-80097. Users and IT administrators should check that affected devices have the relevant update.
Does Gotenberg’s absence from CISA’s list mean it is safe?
No. The roundup says VulnCheck reported 1,358 attack attempts against a critical Gotenberg flaw over 30 days, while the flaw was not on CISA’s Known Exploited Vulnerabilities list. The reported attempts do not, by themselves, establish how many were successful.
Source: ThorstenMeyerAI.com
