🔍 Read the full analysis: AI Security Priorities This Week: Firewall Fixes And Token Protection on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A security roundup published October 29 highlights active attacks involving Fortinet firewall credentials alongside new fixes for Fortinet products. It also covers Android banking malware, a malicious PDF, an Authenticator token flaw Microsoft says it fixed, and gaps in official patch-priority lists.
A security roundup published October 29 puts Fortinet firewalls at the top of this week’s business security priorities, citing fresh Fortinet software updates and a campaign the FBI and U.S. Secret Service say is still targeting firewall accounts with stolen or weak passwords. The report also flags an Android work-token exposure that Microsoft says it has fixed, alongside threats involving fake banking apps, malicious PDFs and automated scanning.
Fortinet released security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, with fixes rated critical and high severity, according to the roundup and Fortinet. The public advisories describing the flaws are scheduled for November 10. Fortinet said AI-assisted testing helped identify issues and warned that attackers may be able to use released patches to develop exploits more quickly. The specific vulnerabilities and affected versions are not detailed in the source material.
Separately, the FBI and U.S. Secret Service warned on October 6 that the FortiBleed credential-theft campaign remains active. The agencies cited SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. That is a security firm’s count, not a figure independently established in the supplied material. The reported method relies on credentials exposed in earlier incidents, weak passwords and password cracking; attackers may then create administrator accounts. The agencies named INC/Lynx and Payload as groups that buy access.
A second set of findings concerns exposed firewall configuration data. Hudson Rock said October 27 that its analysis of 1,703 configuration reports from 1,689 devices found 40,573 records containing plaintext passwords. It cautioned that these are records, not necessarily unique people or currently usable credentials; 7,437 local account records were marked disabled. Other items in the roundup include CloudSEK’s report on the rented Android crime kit MR ROBOT, Trellix’s account of a backdoor delivered through a disguised PDF, and researchers’ report that Microsoft Authenticator for Android could expose work login tokens to another app. Microsoft says it fixed the latter issue.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Firewall Access Leads the List
Firewalls sit at the boundary between a company’s internal systems and the public internet, so access to their administrator accounts can provide a foothold with broad consequences. The campaign described here does not depend on a newly disclosed software flaw: it uses reused or weak credentials. That distinction matters because installing a software update alone may not remove an attacker’s existing access or prevent another login using a compromised password.
The separate Fortinet updates address product vulnerabilities, while the active campaign points to account security and configuration exposure. Organizations may need to treat these as two related but distinct tasks: apply relevant vendor fixes and review credentials, administrator accounts, multifactor authentication and stored configuration files. For individual users, the Android and PDF reports show how routine permissions and document prompts can expose work access or enable malware. The roundup’s core message is practical: prioritize internet-facing systems and account protections, while checking the scope of each advisory before acting.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
As an affiliate, we earn on qualifying purchases.
How This Week’s Alerts Connect
The source article says The Hacker News’ October 29 digest contained 30 stories and selects six it considers especially relevant to businesses and ordinary users. It says the author checked original advisories or research reports where available. The roundup is a curated report, not a notice that all six threats affected the same organizations or were part of one coordinated campaign.
Fortinet’s position, as quoted in the source, is that FortiBleed is not a new Fortinet vulnerability; the campaign relies on credentials from earlier incidents and weak passwords, especially where multifactor authentication is absent. The report also notes that Fortinet released fixes for FortiMail and FortiAuthenticator earlier than the October 22 updates. Its claim that Fortinet products account for nine entries added to CISA’s actively exploited vulnerability catalog in 2026 is the author’s count of that catalog, not a CISA statement about the company as a whole.
“FortiBleed “is not a new Fortinet vulnerability”.”
— Fortinet, as quoted in its June 19 PSIRT statement
What the Advisories Have Not Disclosed
The supplied material does not identify the specific Fortinet vulnerabilities, affected product versions or required upgrade paths; the public advisories are scheduled for November 10. Organizations should consult Fortinet’s official notices for product-specific guidance rather than infer exposure from the roundup alone. The reported compromised-device total and configuration-file counts come from security companies cited by the article, and their methods and full underlying data are not included here.
It is also unclear how many FortiBleed-affected devices remain accessible, how many accounts in the configuration records are active, or how many victims have been identified. For the other stories, the source provides limited detail on the number of confirmed victims and the reach of each threat. Microsoft is reported to have fixed the Authenticator issue, but the supplied material does not specify which Android versions or app releases were affected or when users received the fix.
Actions Before November Advisories
Organizations using Fortinet products should review the vendor’s current security notices and prepare to apply the relevant updates, then check for unfamiliar administrator accounts and exposed or reused credentials. They should also secure stored firewall configurations and verify that multifactor authentication is enabled where supported. The November 10 Fortinet advisories are the next public milestone for details on the October 22 fixes.
Users should update Microsoft Authenticator and Android through official channels, and report unexpected prompts or unusual work-account activity to their IT teams. Businesses should review PDF-reader warnings and avoid approving unexpected requests to open documents. The roundup also recommends checking CISA’s Known Exploited Vulnerabilities catalog, while recognizing that the absence of a flaw from that list does not establish that it is safe to defer. Further details will depend on vendor advisories and subsequent reporting from the agencies and researchers involved.
Key Questions
What is the main security development this week?
The roundup highlights Fortinet software updates and an active campaign using stolen or weak credentials to target firewall accounts. It also reports on threats affecting Android users, work-login tokens and PDF readers.
Does FortiBleed refer to a newly disclosed Fortinet software flaw?
Not according to Fortinet’s statement quoted in the source. Fortinet says the campaign relies on credentials exposed in earlier incidents and weak passwords; the October 22 software fixes are a separate development.
When will details of the Fortinet fixes be public?
The source says Fortinet released updates on October 22 and scheduled the public advisories for November 10, 2026. It does not list the affected versions or specific vulnerabilities.
How reliable are the reported firewall-compromise figures?
The figures are attributed to security companies cited by the article. SOCRadar reportedly verified more than 86,644 compromised devices; Hudson Rock counted password records in configuration reports and cautioned that records do not equal people or necessarily active accounts.
What should organizations do now?
Check Fortinet’s official notices for applicable updates, review administrator accounts and credentials, secure configuration backups, and use multifactor authentication where available. Treat the vendor’s advisory as the source for product-specific remediation.
Source: ThorstenMeyerAI.com
