🔍 Read the full analysis: This Week In AI Cybersecurity: Firewall Repairs And Threat Response on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Fortinet released critical and high-severity updates for FortiOS, FortiManager and FortiAnalyzer on October 22, while U.S. agencies warned that attacks using stolen Fortinet credentials remain active. The October 29 roundup also describes an Android banking fraud kit, a backdoor delivered through a disguised PDF, an Android Authenticator flaw Microsoft has fixed, and disagreements between attack activity and official patch lists.
A cybersecurity roundup published October 29 reports that Fortinet issued critical and high-severity updates for FortiOS, FortiManager and FortiAnalyzer, as the FBI and U.S. Secret Service warned that attackers are still targeting Fortinet firewalls with stolen or weak credentials. The developments matter to businesses because internet-facing network devices can provide access to wider company systems, while the same roundup describes threats aimed at phones, email users and security teams’ patch priorities.
Fortinet released the updates on October 22. The company said the fixes address critical and high-severity issues and that they were found with assistance from AI-based testing. Fortinet thanked Anthropic, OpenAI, Google and SpaceX for their help. The public advisories are scheduled for November 10, leaving details of the flaws undisclosed for now.
Separately, the FBI and U.S. Secret Service said the FortiBleed campaign remains active. Their advisory cited security firm SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. According to the roundup’s account of the campaign, attackers reuse exposed passwords, target weak credentials and exploit password files stored using a legacy method. They may then create administrator accounts and sell access. The agencies named ransomware groups INC/Lynx and Payload as buyers.
The roundup also summarizes four other reports: CloudSEK described MR ROBOT, a rented Android crime kit for creating fake banking apps; Trellix traced a backdoor to a disguised, empty PDF; researchers reported that an Android app could obtain Microsoft Authenticator work-account tokens, a flaw Microsoft has fixed; and Cequence tracked a scanner impersonating roughly 32 AI-bot identities while seeking password files and cloud keys. The source also contrasts CISA’s three-day deadline for federal agencies to fix PHP2Shell with VulnCheck’s report of 1,358 Gotenberg attack attempts in 30 days, even though Gotenberg was not on CISA’s Known Exploited Vulnerabilities list.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Firewall Access Can Expose Networks
The firewall reports point to two separate security concerns: newly issued product fixes and an ongoing campaign that, according to the agencies, relies on compromised or weak credentials. Patching addresses known software weaknesses, but it does not by itself remove reused passwords or secure exposed administrator accounts. Organizations using Fortinet devices need to address both software updates and account security.
The other reports show how varied the risks are for individuals and IT teams. A fake banking app that intercepts one-time codes, a malicious file that depends on a user approving a warning, and stolen authentication tokens can each undermine account protection in different ways. Meanwhile, the Gotenberg figures suggest that an official must-patch list is not a complete inventory of reported attack activity; the reported attempts are not, by themselves, proof of successful compromises.
Popular right now
Ninja Flip Toaster Oven and Air Fryer, 8-in-1, Stainless Steel, SP151
Ninja CREAMi Scoop & Swirl 13-in-1 Ice Cream and Soft Serve Maker, NC701
Dyson Car+Boat Cordless Handheld Vacuum
As an affiliate, we earn on qualifying purchases.
Six Reports Across the Attack Surface
The source article says it selected six stories from a 30-item Hacker News digest, then checked original advisories or research reports where available. It cautions that many of the figures came from security firms that discovered the issues and also sell security products. Those figures are useful indicators, but readers should keep their origin and measurement limits in view.
For example, Hudson Rock analyzed 1,703 firewall configuration reports from 1,689 devices and counted 40,573 records containing plaintext passwords. It said 7,437 local user accounts were marked disabled, and emphasized that the records do not represent a count of people or necessarily active credentials. Fortinet has said FortiBleed is not a new Fortinet vulnerability, attributing the campaign to reused credentials, weak passwords and missing multifactor authentication. The roundup also notes that CISA added nine Fortinet entries to its actively exploited vulnerability catalog in 2026, based on the author’s count.
“FortiBleed “is not a new Fortinet vulnerability.””
— Fortinet
Advisory Details Remain Pending
Fortinet’s public advisories are not due until November 10, so the roundup does not provide the affected product versions, vulnerability identifiers or detailed remediation guidance for the October 22 updates. The available information also does not establish how many of the firewall devices cited in the separate credential campaign remain exposed or whether particular organizations have been affected.
Several figures come from researchers’ own datasets, with different methods and scopes; they should not be treated as a single measure of successful attacks. The Gotenberg count refers to recorded attempts over 30 days, not confirmed intrusions. The roundup provides limited technical detail for the mobile and PDF threats, and does not state how many users or organizations were affected. Microsoft’s fix is reported, but the source does not specify its rollout status across all devices.
Patch Updates and Secure Accounts
Fortinet customers should review the company’s security guidance and apply the relevant updates, then check for weak or reused administrator credentials, unexpected accounts and missing multifactor authentication. Organizations should also watch for Fortinet’s November 10 advisories to identify the precise flaws and affected versions.
For other systems, IT teams can review CISA’s vulnerability catalog alongside vendor advisories and credible reports of exploitation, rather than treating the catalog as an exhaustive patch list. Android users should install available security updates, obtain banking apps from trusted sources and avoid approving unexpected file-reader warnings. The source material does not provide a timetable for further findings on MR ROBOT, the PDF backdoor or the reported scanner activity.
Key Questions
What is the main Fortinet development?
Fortinet released critical and high-severity updates for FortiOS, FortiManager and FortiAnalyzer on October 22. Public advisories with more detail are expected November 10.
What is FortiBleed, according to the report?
It is a campaign that the FBI and U.S. Secret Service said remains active and targets Fortinet firewalls using stolen or weak credentials. Fortinet says it is not a new product vulnerability.
Does the Gotenberg figure confirm successful attacks?
No. VulnCheck reported 1,358 recorded attack attempts in 30 days. That number does not establish how many attempts succeeded or whether systems were compromised.
Has the Microsoft Authenticator issue been fixed?
The roundup says Microsoft fixed the reported Android issue involving work-account login tokens. It does not specify whether the fix has reached every affected device, so users should check for available app and system updates.
Source: ThorstenMeyerAI.com
