🔍 Read the full analysis: What This Week’s Trojan And PDF Stories Mean For AI Security on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A security roundup published October 29 highlights six developments: an active Fortinet firewall campaign, a rented Android banking trojan, a backdoor delivered through a deceptive PDF, an Android authentication flaw, an automated scanner impersonating AI bots and a gap in a federal patch-priority list. The incidents show familiar security weaknesses being used at scale; the material does not establish that AI caused the attacks.
A security roundup published October 29 highlights six recent threats, including an active campaign targeting Fortinet firewalls, an Android banking kit rented to criminals and a backdoor hidden in a deceptive PDF. The incidents matter to businesses and individual users because they show attackers exploiting stolen credentials, user approvals and software trust; the reports do not establish that artificial intelligence caused these attacks.
The roundup, based on a weekly digest from The Hacker News and original advisories or research cited by its author, says the FBI and U.S. Secret Service warned on October 6 that the FortiBleed campaign remains active. The agencies cited SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. The campaign reportedly reuses previously leaked or weak passwords to gain access to Fortinet devices. Those counts are attributed to the security firms, not presented as an independent government census.
Fortinet separately issued security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, with critical and high-severity fixes. Public advisories for the issues were scheduled for November 10, according to the source material. The roundup distinguishes these newly released updates from FortiBleed: Fortinet says that campaign is not a new Fortinet vulnerability, but relies on exposed or weak credentials. The source also cites Hudson Rock’s October 27 analysis of firewall configuration reports, which found plaintext password records; the company cautioned that records are not the same as active user accounts and that some were disabled.
Other reports describe different entry points. CloudSEK reported an Android crime kit called MR ROBOT, offered to criminals under a rental model and used to create fake banking apps that can steal one-time codes and forward calls. Trellix said it traced a backdoor to an empty PDF disguised as a FedEx tax invoice; the described infection depended on a user accepting a PDF reader warning. Separately, Enclave researchers reported that an Android flaw could expose Microsoft Authenticator work-account tokens to another app. Microsoft has fixed the issue, listed as CVE-2026-80097, according to the source material.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
How Familiar Weaknesses Open Doors
The reports matter because they connect routine security decisions to concrete risks: a reused password can expose a network perimeter, a user’s approval can let a malicious file proceed, and an authentication flaw can put work-account tokens at risk. The examples span companies’ firewalls and employees’ phones, so protections cannot rest on a single software patch or security product.
The roundup also cautions against treating AI as the explanation for every new threat. One cited scanner rotated through about 32 claimed AI-bot identities while requesting password files and cloud keys, according to Cequence. That is a report about impersonation and automated scanning, not proof that the scanner was an AI system. Similarly, Fortinet said AI-assisted testing contributed to finding issues addressed in its updates. The security implications are real, but the material does not confirm that AI itself powered the attacks described.
For defenders, patch timing and credential hygiene both matter. Fortinet warned that AI tools could help attackers reverse-engineer patches and develop exploits faster. That is the company’s assessment, not a measured timeline for these specific flaws. Still, it reinforces why organizations should apply relevant fixes promptly, while separately reviewing exposed credentials, multifactor authentication and access to configuration backups.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Apple Watch SE 3 GPS 44mm Smartwatch
As an affiliate, we earn on qualifying purchases.
Six Reports Behind the Roundup
The source article is a selection of six stories from The Hacker News’ October 29 weekly digest, which it says contained 30 items. Its author says the original advisories and research reports were consulted, while noting that many figures come from security companies that also sell protection services. Those findings are attributed to the firms rather than treated as independently verified totals.
The remaining two items concern an automated scanner and patch prioritization. Cequence reported a scanner using multiple fake AI-bot identities to seek sensitive files and cloud keys. The roundup also says CISA gave U.S. federal agencies three days to address PHP2Shell, while a critical Gotenberg flaw was absent from the agency’s Known Exploited Vulnerabilities catalog. VulnCheck reported 1,358 recorded attack attempts over 30 days involving Gotenberg; that figure is a reported observation, and the supplied material does not give a comparison baseline.
Together, the stories point to a practical distinction: official priority lists help direct remediation but do not necessarily capture every risk a security team may need to assess. The roundup’s examples also differ in status and evidence, ranging from vendor patches and government warnings to private-sector research reports.
““A firewall backup is the building’s master key ring and the staff list in one envelope.””
— Thorsten Meyer, author of the October 29 roundup
What the Reports Do Not Establish
The source material does not independently verify the security firms’ device, credential or attack-attempt counts, and those figures have different scopes. Hudson Rock’s password records do not establish how many accounts remain usable; its report, as summarized, includes disabled accounts. It is also unclear from the supplied material how many organizations were affected by the Android kit, PDF backdoor or Authenticator flaw.
The public details of Fortinet’s October 22 fixes were not due until November 10, so the specific vulnerabilities and their exposure are not described here. The source does not say whether the cited scanner used AI, only that it claimed several AI-bot identities. Nor does it show that AI caused the trojan, PDF or firewall campaign. The circumstances and impact of the reported Gotenberg attempts are also not fully detailed.
Patch, Verify and Track Advisories
Organizations using FortiOS, FortiManager or FortiAnalyzer should review Fortinet’s available updates and follow the company’s advisories when fuller details are published. Security teams can also check for exposed or reused credentials, protect firewall configuration backups, review administrator accounts and require multifactor authentication where available. The roundup’s central practical message is to treat these as separate controls, not substitutes for one another.
Android users and their employers should apply Microsoft’s fix for CVE-2026-80097 and install apps only from trusted sources. Users should be cautious when a document reader asks for permission to proceed with a suspicious file. Security teams should continue to monitor CISA’s KEV catalog while assessing credible threat reports that fall outside it. Further information is expected as vendors and researchers publish advisories and additional technical details.
Key Questions
What is the main development in this week’s security roundup?
The October 29 roundup selects six reports involving Fortinet firewall attacks, Android malware, a malicious PDF, an authentication flaw, automated scanning and patch prioritization. It is a summary of separate developments, not one coordinated incident.
Did AI cause the attacks described?
The supplied reports do not establish that AI caused the attacks. One scanner reportedly used fake AI-bot identities, and Fortinet said AI-assisted testing helped identify some issues fixed in its updates. Those points do not show that AI powered the campaigns.
What is FortiBleed, according to the cited material?
It is a campaign targeting Fortinet devices by reusing leaked or weak credentials, according to the FBI and U.S. Secret Service warning summarized in the source. Fortinet said it is not a new Fortinet vulnerability.
What should organizations do about the Fortinet reports?
Review and apply relevant Fortinet security updates, follow the vendor’s advisories as more details appear, and check for weak or reused credentials and exposed configuration files. The source says fuller public advisories for the October 22 updates were scheduled for November 10.
Has the Microsoft Authenticator issue been fixed?
Yes. The source material says Microsoft fixed the reported Android issue, identified as CVE-2026-80097. Users and organizations should apply the available fix and follow Microsoft’s guidance.
Source: ThorstenMeyerAI.com
