TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security reports published through October 29 describe urgent Fortinet fixes, an active campaign targeting firewall credentials, and threats to Android banking users and work account tokens. The reports also highlight a malicious PDF, fake AI bot identities used to seek secrets, and exploited software that is absent from CISA’s must-patch list.
Six security developments reported this week point to immediate steps for businesses and individual users: install Fortinet’s October fixes, update Microsoft Authenticator on Android, and treat unsolicited PDFs and banking app links with caution. The reports include an active Fortinet credential-theft campaign and a fixed flaw that could expose work-account tokens.
Fortinet released fixes for FortiOS, FortiManager and FortiAnalyzer on October 22 and asked customers to prioritize the changes. The FBI and U.S. Secret Service have warned that a campaign dubbed “FortiBleed,” targeting Fortinet firewalls to steal passwords, remains active. Fortinet has said technical details of the fixes will stay private until November 10. Hudson Rock, a security company, reported finding 40,573 records with plain-text passwords across 1,703 firewall reports; these are the company’s counts, not an official government tally.
CloudSEK reported that an Android crime kit called MR ROBOT is rented to criminals to create fake banking apps. The kit can steal one-time codes and secretly forward calls, according to the security firm. CloudSEK said one affiliate had 153 devices and sent 5,407 text messages. Separately, Trellix traced a backdoor to an empty PDF disguised as a FedEx tax invoice. Its report said the malicious activity depended on a user approving the PDF reader’s warning.
Researchers at Enclave said another app could obtain work-account login tokens from Microsoft Authenticator on Android, despite having no permissions. Microsoft has fixed the issue, tracked as CVE-2026-80097. Cequence reported that one scanner cycled through about 32 purported AI-bot identities while requesting password files and cloud keys from websites. The figures and observations about the scanner come from Cequence’s research.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
Where the Risks Reach Users
The reports involve common paths into personal and business accounts: internet-facing firewalls, mobile banking, email attachments and authentication apps. A firewall credential can expose remote access; a stolen one-time code may help criminals enter a bank account; and work tokens can grant access to organizational services. These risks make timely updates and careful handling of login prompts and files relevant beyond security teams.
The reports also show why a software vendor’s patch list cannot stand in for an organization’s own exposure review. CISA’s Known Exploited Vulnerabilities catalog is a priority resource for U.S. federal agencies, but the source material says a critical Gotenberg flaw was not listed despite recorded attack attempts. Organizations that use the software may need to check for other evidence of exploitation and prioritize internet-facing systems.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels
Bose TV Speaker (2nd Gen) Compact Soundbar with Bluetooth and HDMI
As an affiliate, we earn on qualifying purchases.
How This Week’s Risks Connect
The six developments appeared in a weekly digest from The Hacker News dated October 29. The article summarized them after checking the original advisories or research reports. The cases share a practical pattern: attackers can take advantage of exposed services, reused or stolen credentials, a user’s approval, or misplaced trust in an app’s identity. That is the article’s interpretation of the reports, rather than a finding attributed to a single investigation.
For patch planning, the source cites CISA adding PHP2Shell to its Known Exploited Vulnerabilities catalog on October 26, with a deadline of October 29 for U.S. federal agencies to remediate it. VulnCheck separately recorded 1,358 Gotenberg attack attempts in 30 days, but the source does not specify the methodology or say those attempts succeeded. Gotenberg was not on the cited CISA list. These figures have different sources and should not be read as a direct comparison of risk.
“Customers should treat the October 22 fixes as a priority change.”
— Fortinet
Details Still Under Wraps
Fortinet’s technical details are not due for release until November 10, so the source material does not establish the full scope of the October fixes or how the active campaign is operating. It also does not say how many organizations have been affected or whether any particular firewall report corresponds to a successful intrusion.
The reported figures from Hudson Rock, CloudSEK, Cequence and VulnCheck are attributed to those companies. The source material does not provide enough methodology to independently assess the counts, establish how representative they are, or determine how many attempts led to compromise. It also does not identify affected banks or provide a list of targeted websites. For the Authenticator flaw, the material confirms a fix but does not specify how many users installed vulnerable versions or whether attackers exploited the issue in real-world incidents.
Patches and Further Advisories
Fortinet is expected to publish more detail on November 10. Organizations using the affected products should review Fortinet’s advisories, apply the October updates, and check firewall administration access and VPN or administrator passwords. IT teams should also confirm that Android devices meet their required Microsoft Authenticator version and review CISA’s catalog alongside other credible reports of exploitation when setting patch priorities.
Individual users can reduce exposure by installing bank apps from official app stores, declining prompts from PDFs that ask to launch another program, and applying available app updates. The source material does not set a date for further public findings on MR ROBOT, the malicious PDF, the scanner activity or Gotenberg; additional scope and incident details may emerge as researchers and affected organizations investigate.
Key Questions
Which Fortinet products received fixes?
FortiOS, FortiManager and FortiAnalyzer received fixes on October 22, according to the source material. Fortinet’s technical details are scheduled for release November 10.
What does the MR ROBOT kit do?
CloudSEK says it is a rented Android crime kit used to build fake banking apps that can steal one-time codes and secretly forward calls. The reported device and text totals are CloudSEK’s counts.
Has the Microsoft Authenticator issue been fixed?
Yes. The Android issue, tracked as CVE-2026-80097, has been fixed by Microsoft, according to the source material. Organizations should check that managed devices have the required app update.
Does CISA’s list include every exploited vulnerability?
No. The source says Gotenberg was not on the cited CISA Known Exploited Vulnerabilities catalog, while VulnCheck reported 1,358 attack attempts in 30 days. CISA’s list is a priority resource, but the reported omission means teams may need other sources to assess exposure.
Source: Thorsten Meyer AI
![Paged Out #9 [Pdf]](https://vultrade.com/wp-content/uploads/2026/07/paged-out-9-pdf-featured-560x300.jpg)
