🔍 Read the full analysis: From Firewall Fixes To Stolen Tokens: An AI Security Action Guide on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A ThorstenMeyerAI.com roundup dated Oct. 29 selects six security developments from The Hacker News’ weekly digest and pairs each with an action for businesses or users. It highlights Fortinet updates and an active firewall credential-theft campaign, alongside risks involving Android banking malware, a malicious PDF, work-account tokens, AI-bot impersonation and patch prioritization.
ThorstenMeyerAI.com published a six-story security action guide on Oct. 29, selecting business and consumer risks from The Hacker News’ weekly digest and checking the original advisories or research reports. The report puts Fortinet firewall updates and an active campaign using stolen or weak credentials among its leading concerns, while also covering Android banking malware, a malicious PDF, work-account tokens, automated scanning and patch priorities.
The roundup says Fortinet issued critical- and high-severity updates for FortiOS, FortiManager and FortiAnalyzer on Oct. 22. It reports that public advisory details are scheduled for Nov. 10. Separately, the FBI and U.S. Secret Service warned on Oct. 6 that a campaign dubbed FortiBleed remains active. The agencies cite SOCRadar’s count of more than 86,644 compromised devices across 194 countries; that figure is attributed to the security firm, not presented as an independently verified government count.
The guide describes attackers reusing previously leaked passwords, guessing weak credentials and targeting firewall configuration data. According to the report, the FBI and Secret Service said the actors create administrator accounts and may lock out legitimate administrators. Hudson Rock’s Oct. 27 analysis of 1,703 configuration reports from 1,689 devices counted 40,573 password-containing records. The company cautioned that these were records, not necessarily active accounts or individual people; 7,437 local accounts were marked disabled.
The other items include MR ROBOT, an Android crime kit that CloudSEK said criminals rent to make fake banking apps capable of stealing one-time codes and forwarding calls; and Trellix’s account of a backdoor delivered through an empty PDF disguised as a FedEx tax invoice. The guide also cites researchers’ report that Microsoft Authenticator on Android could be manipulated into exposing work-account login tokens to another app, a flaw Microsoft has fixed. Cequence reported one scanner rotating among about 32 fake AI-bot identities while seeking password files and cloud keys. Finally, it contrasts CISA’s three-day deadline for federal agencies to address PHP2Shell with VulnCheck’s report of 1,358 Gotenberg attack attempts in 30 days, despite that flaw not appearing on CISA’s Known Exploited Vulnerabilities catalog.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Practical Steps for Exposed Systems
The cases point to risks that can affect both an organization’s network perimeter and individual accounts. Firewall credentials and configuration backups can expose access beyond the device itself, while token theft can put a work account at risk even when the targeted authentication app has few apparent permissions. Fake banking apps and malicious attachments can also exploit user trust rather than a newly discovered software flaw.
The guide’s value is its focus on actions rather than a long list of headlines. For administrators, it calls for prioritizing Fortinet updates, reviewing firewall accounts and protecting stored configuration files. For users, the examples support caution around unexpected PDFs and requests to approve access. The report’s distinction between vendor counts, researcher observations and confirmed agency statements matters: the figures describe specific investigations, not a complete measure of all affected devices or users.
Patch lists can help set priorities, but the Gotenberg example shows why organizations may also need to assess credible threat reporting beyond a single catalog. A vulnerability’s absence from CISA’s list does not, on its own, establish that it is safe or unexploited. Teams need to weigh their own exposure, available fixes and reliable evidence of attacks.
Popular right now
Breville Bambino Espresso Machine, Brushed Stainless Steel (BES450BSS)
TCL QM64L 85-Inch QD-Mini LED 4K Smart Fire TV
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
As an affiliate, we earn on qualifying purchases.
How the Six Risks Connect
The source article says The Hacker News published a 30-story security digest on Oct. 29, from which its author selected six items. It says the author reviewed the original advisories or research for each selection. The report also warns that many figures come from security companies that sell protective services; it attributes company counts rather than treating them as neutral, complete tallies.
For FortiBleed, Fortinet has disputed the characterization of the campaign as a new Fortinet vulnerability. The company said the activity relies on credentials exposed in earlier incidents, weak passwords and the absence of multifactor authentication. The roundup distinguishes that campaign from Fortinet’s separate Oct. 22 software updates, which address critical and high-severity flaws. It says Fortinet credited AI-assisted testing and scheduled public advisory details for Nov. 10.
The six items span different attack routes: exposed network appliances, malicious mobile software, a deceptive document, account-token handling, automated impersonation and vulnerability triage. The article’s shared theme is that attackers may exploit existing weaknesses in credentials, software behavior or user decisions; it does not claim that all six incidents are part of one campaign.
“AI tools can now help attackers “reverse-engineer patches and build working exploits in hours or days, rather than weeks”.”
— Fortinet, describing the effect of AI tools
What the Counts Do Not Show
The cited totals do not establish how many currently active users or devices remain exposed. SOCRadar’s figure is described as more than 86,644 compromised devices, while Hudson Rock’s analysis counts records and includes accounts marked disabled. Hudson Rock said the records are not equivalent to people, and the report does not establish how many credentials still work.
The article does not provide the full technical details of Fortinet’s Oct. 22 fixes, which it says are due to appear in public advisories on Nov. 10. It also does not give enough information to independently assess each security company’s methodology or to determine the extent of real-world harm from the Android kit, PDF backdoor, token flaw or scanner. The reported Gotenberg attempt count covers a specified 30-day period, but the source does not detail how those attempts were identified or how many succeeded.
Updates and Defensive Checks
Fortinet’s public advisories are expected on Nov. 10, according to the roundup. Administrators should consult the company’s published instructions when available and check whether FortiOS, FortiManager, FortiAnalyzer and other affected products are covered by relevant updates. The article also points to reviewing firewall accounts, removing unnecessary access, changing exposed or reused passwords and enabling multifactor authentication.
Organizations should review their own exposure to the other reported risks, including the fixed Microsoft Authenticator issue and vulnerabilities in software they operate. Security teams can compare CISA’s KEV catalog with vendor notices and credible research, while recording the source, time window and meaning of any attack counts. For users, the guide’s immediate cautions are to treat unexpected documents carefully, avoid installing banking apps from untrusted sources and question requests for account approval. The source provides no further confirmed incident updates beyond those scheduled advisories and actions.
Key Questions
What is the actual news in this report?
ThorstenMeyerAI.com published a six-item security guide on Oct. 29, drawing on The Hacker News’ weekly digest and linking the selected risks to practical actions.
Does FortiBleed refer to the Oct. 22 Fortinet updates?
No. The roundup distinguishes the active FortiBleed campaign, which Fortinet attributes to weak or reused credentials, from separate critical- and high-severity software updates released Oct. 22.
How many devices were compromised in the campaign?
The FBI and U.S. Secret Service advisory cited SOCRadar’s count of more than 86,644 compromised devices across 194 countries. That is an attributed company estimate; the source does not establish a complete, independently verified total.
Was the Android Authenticator issue fixed?
The roundup says Microsoft has fixed the reported Android issue that researchers said could expose work-account login tokens to another app. Readers and administrators should refer to Microsoft’s advisory for applicable versions and remediation details.
Why mention Gotenberg if it is not on CISA’s KEV list?
The report says VulnCheck recorded 1,358 Gotenberg attack attempts in 30 days, while the flaw was not on CISA’s catalog at the time. The count does not by itself prove successful compromises, but the example shows that teams may need to review other credible threat information alongside the catalog.
Source: ThorstenMeyerAI.com
