TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
This week’s security roundup highlights Fortinet firewall updates, an Android banking crime kit offered for rent, and a backdoor delivered through a blank PDF. Researchers also reported a Microsoft Authenticator flaw that has been fixed, a scanner posing as AI bots, and a gap between CISA’s required patch list and other reported exploitation.
A security roundup published October 29 highlights six developments affecting business networks, phones and online services, including Fortinet firewall fixes, rented Android banking malware and a malicious PDF. The selected reports point to practical steps for organizations and users, from installing updates to treating unexpected permission prompts with caution.
Fortinet released updates on October 22 for FortiOS, FortiManager and FortiAnalyzer, including critical and high-severity fixes. The company has not yet published the technical details; the roundup says those are scheduled for November 10. Separately, the FBI and US Secret Service have warned that a campaign called FortiBleed, involving theft of firewall passwords, remains active. Hudson Rock reported finding 40,573 plaintext password records in 1,703 firewall reports, a count attributed to the security company.
CloudSEK reported on October 28 that an Android crime kit named MR ROBOT is rented to criminals. The kit can be used to create fake banking apps that steal one-time codes and forward calls. CloudSEK described one affiliate’s activity as involving 153 devices and 5,407 text messages. Trellix, in a report dated October 26, traced a backdoor to an empty PDF disguised as a FedEx tax invoice; according to the researchers, the attack proceeded after a user accepted the PDF reader’s warning.
Other reports covered a Microsoft Authenticator issue on Android, a web scanner impersonating AI bots, and patch prioritization. Enclave said an app with no permissions could obtain work-account login tokens through Authenticator; Microsoft has fixed the issue, tracked as CVE-2026-80097. Cequence reported that one scanner used about 32 AI-bot identities while requesting sensitive files and keys. CISA added PHP2Shell to its Known Exploited Vulnerabilities catalog and gave US federal agencies three days to address it. VulnCheck separately recorded 1,358 Gotenberg attack attempts over 30 days; the roundup says Gotenberg was not on that CISA list.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
Risks Across Firewalls and Phones
The reports matter because they cover systems that often sit between attackers and sensitive accounts: internet-facing firewalls, workplace authentication apps and banking apps on personal phones. A compromised firewall password can put network access at risk, while stolen login tokens or one-time codes can give criminals a path into accounts. The roundup also describes a malicious document attack that depended on a user approving a warning, showing how software prompts can become part of an attack chain.
For IT teams, the reports argue for acting on more than one source of patch guidance. CISA’s catalog helps federal agencies prioritize known exploited vulnerabilities, but the Gotenberg figures cited by VulnCheck illustrate that security teams may also need to weigh reports of exploitation, exposure to the internet and their own software inventory. The published counts come from the named security firms and should be read as their observations, not as a complete measure of all attacks.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Bose TV Speaker (2nd Gen) Compact Soundbar with Bluetooth and HDMI
As an affiliate, we earn on qualifying purchases.
Reports Behind the Six Stories
The roundup says its author selected six stories from a 30-story weekly digest published by The Hacker News and checked them against original advisories or research reports. The source list includes Fortinet, the FBI and US Secret Service, Hudson Rock, CloudSEK, Trellix, Enclave, Microsoft, Cequence, CISA and VulnCheck. Several figures in the roundup are researchers’ own counts, and the source material does not establish that they represent all affected users, devices or attacks.
The cited developments were reported between October 6 and October 28, 2026. Fortinet’s updates arrived on October 22, while the company’s technical disclosure is scheduled for November 10. CISA added PHP2Shell to its catalog on October 26, with the stated October 29 deadline applying to US federal agencies. Microsoft’s Authenticator issue is described as fixed, though organizations may still need to confirm that devices are running a version that includes the fix.
“One MR ROBOT affiliate was associated with 153 devices and 5,407 text messages.”
— CloudSEK
What the Reports Do Not Establish
The available material does not state how many Fortinet customers were affected by the FortiBleed campaign or how many have installed the October 22 fixes. Fortinet’s technical details are still pending. The reported Hudson Rock password records also do not establish how many distinct organizations or active accounts were exposed.
The MR ROBOT figures describe one affiliate, and the source does not give a total number of operators, victims or financial losses. The Trellix account does not establish how widely the PDF lure circulated. For the Authenticator issue, the material confirms that Microsoft issued a fix but does not give the number of affected installations or the share of users who have updated. Cequence’s bot count and VulnCheck’s Gotenberg attempt count are company-reported observations; the source does not provide a complete measure of activity across the web.
Updates and Patch Deadlines
Fortinet’s scheduled November 10 publication should provide more detail about the October 22 fixes. Organizations using the affected products can review Fortinet’s advisories, apply the relevant updates and check whether firewall administrative access and associated credentials need further attention. The FBI and US Secret Service warning means teams should also review their exposure to the reported password-theft campaign.
US federal agencies were given until October 29 to address PHP2Shell under the CISA deadline cited in the roundup. Other organizations can use the KEV catalog as one input to patch planning, while reviewing credible exploitation reports for software they run, including Gotenberg. Android users and IT teams should check that Authenticator is updated to a version containing Microsoft’s fix. The cited reporting does not give a later timetable for additional advisories or investigations.
Key Questions
What are the main security developments in this roundup?
The six stories cover Fortinet firewall updates, the FortiBleed password-theft campaign, rented Android banking malware, a malicious blank PDF, a fixed Microsoft Authenticator issue, a scanner posing as AI bots and patch priorities.
What should organizations do about the Fortinet updates?
Review Fortinet’s advisories for FortiOS, FortiManager and FortiAnalyzer, install applicable fixes and assess firewall administrative access and credentials. Fortinet’s technical details for the October 22 fixes are scheduled for November 10, according to the source material.
How does the MR ROBOT Android kit work?
CloudSEK says the rented kit helps criminals create fake banking apps that can steal one-time codes and secretly forward calls. The reported figures for one affiliate do not indicate the kit’s total reach.
Has Microsoft fixed the Authenticator issue?
Yes. The source material says Microsoft fixed the Android issue tracked as CVE-2026-80097. Users and IT teams should check that devices have the updated version.
Does CISA’s vulnerability catalog cover every urgent patch?
No. The roundup says PHP2Shell was added to CISA’s Known Exploited Vulnerabilities catalog, while Gotenberg was not listed despite VulnCheck’s report of 1,358 attack attempts over 30 days. That count is VulnCheck’s observation, and the source does not provide a complete measure of attacks.
Source: Thorsten Meyer AI
