TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A review dated October 29 highlights six security developments, from active Fortinet password theft to malicious Android apps and a PDF-based backdoor. The reports point to practical steps: patch exposed systems, update apps, reject suspicious prompts and check exploited software beyond the official federal list.
A security roundup published October 29 singled out six risks for businesses and individual users, including an active campaign targeting Fortinet firewalls, rented Android malware used to impersonate banks, and a backdoor delivered through a deceptive PDF. The report ties each item to a practical response, as security teams face fixes to apply and users face familiar lures arriving through phones, inboxes and websites.
The firewall issue carries an immediate operational concern. Fortinet released critical and high-severity fixes on October 22 for FortiOS, FortiManager and FortiAnalyzer. The FBI and U.S. Secret Service have warned that a campaign dubbed “FortiBleed,” involving theft of firewall passwords, remains active, according to the roundup. Hudson Rock separately counted 40,573 records containing plaintext passwords in 1,703 firewall reports. That figure is the security company’s count; it is not a measure of confirmed victims across all Fortinet customers. The recommended response is to install the fixes, remove administrator access from the public internet where possible, and reset VPN and administrator passwords.
Two reports concern Android phones. CloudSEK described MR ROBOT, a crime kit rented to operators who use it to create fake banking apps. The kit can capture one-time codes and secretly forward calls, according to the company’s October 28 report. CloudSEK said one affiliate’s activity involved 153 devices and 5,407 text messages. The roundup advises users to install banking apps through official app stores, not links in messages. Separately, researchers at Enclave reported that another app with no permissions could obtain work-account login tokens from Microsoft Authenticator on Android. Microsoft fixed the issue, tracked as CVE-2026-80097; organizations should update the app and set a minimum acceptable version.
A third user-facing report describes a hidden backdoor delivered through an empty PDF disguised as a FedEx tax invoice. Trellix said the malicious activity proceeded only after a recipient accepted the PDF reader’s warning. The advice is direct: decline a prompt asking a PDF to launch another program, especially when the document was unexpected. For website operators, Cequence reported that one scanner rotated through about 32 purported AI-bot identities while requesting files that can expose passwords, cloud keys and SSH credentials. The number refers to the company’s observation of one scanner, not a count of all automated scanners.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
Six Risks, Four Common Weak Spots
The reports matter because they connect different-looking incidents to ordinary points of failure: internet-facing administrative access, reused or stolen credentials, user approval prompts and misplaced trust. That pattern gives organizations a way to turn a long news digest into a short set of defensive tasks. Firewall maintenance and app updates are within administrators’ control; careful handling of links and PDF warnings is within users’ reach.
The stories also show why relying on a single security signal can leave gaps. A bot’s chosen name does not establish that it is a legitimate AI service. An app’s lack of permissions did not prevent the Authenticator token issue described by researchers. A federal list of known exploited vulnerabilities helps prioritize work, but it does not include every flaw under active attack or facing attempted exploitation. These distinctions affect where teams spend limited response time.
The figures in the reports help establish what researchers observed, but their scope matters. CloudSEK’s device and text counts, Cequence’s bot identities and VulnCheck’s attack-attempt tally are company-reported observations with the stated sources and windows. They should not be treated as universal totals or direct estimates of successful breaches. The actionable point is to use those findings as leads for checking exposure, while keeping the underlying measurement and timeframe attached.
Products Worth Considering
DJI Osmo Mobile 7P Phone Gimbal with Mic Mini Transmitter, Infinity Black
Jackery Explorer 300 Portable Power Station, 292Wh
Bose SoundLink Flex Bluetooth Speaker (2nd Gen), Black
As an affiliate, we earn on qualifying purchases.
The Week’s Reports and Deadlines
The roundup starts with a 30-item weekly digest from The Hacker News, then selects six stories it considers most relevant to organizations and ordinary users. Its author says the items were checked against original advisories or research reports. The coverage spans software fixes, criminal tools, a malicious document, an authentication issue, automated scanning and vulnerability prioritization. The source material also notes that many figures come from cybersecurity companies that sell security products, so their counts are attributed to those firms.
For patch planning, the roundup compares PHP2Shell and a flaw in the document tool Gotenberg. CISA added PHP2Shell to its Known Exploited Vulnerabilities catalog on October 26 and gave U.S. federal agencies until October 29 to address it. VulnCheck reported 1,358 recorded exploitation events involving Gotenberg over 30 days, as of its October 26 report; the roundup says Gotenberg does not appear on CISA’s list. The figure is an event count reported by VulnCheck, not a confirmed count of compromised systems.
Fortinet’s October 22 fixes and the law enforcement warning about the ongoing password-theft campaign make firewall checks time-sensitive. Fortinet has set November 10 as the date for publishing further details about the fixes, according to the source material. Until then, customers have the vendor’s updates and the public warning as grounds to review their exposure and credentials.
“One MR ROBOT affiliate was associated with 153 devices and 5,407 text messages.”
— CloudSEK
The Scale of Exposure Remains Unknown
The reports do not establish how many organizations or people were successfully compromised in the incidents they describe. Hudson Rock’s password records, CloudSEK’s affiliate counts, Cequence’s scanner observations and VulnCheck’s exploitation-event tally each reflect specific research methods and scopes. The source material does not provide a common baseline that would allow those numbers to be compared or combined.
It is also unclear from the roundup how many Fortinet customers have installed the October 22 fixes, or how many were affected by the campaign described by law enforcement. Details about the Fortinet issues are scheduled for November 10. The material does not give a total number of victims from the Android campaigns, the PDF backdoor or the Authenticator issue. The fact that Microsoft fixed CVE-2026-80097 does not show how many users were exposed before updating.
Finally, a vulnerability’s absence from CISA’s catalog does not establish that it is safe to defer. The roundup cites VulnCheck’s Gotenberg figure, but does not supply the underlying event records or explain how those attempts were verified. Security teams should treat each source’s scope and wording carefully when deciding whether their own systems are affected.
Patch, Check Access and Update Apps
Organizations should review their Fortinet deployments, apply the available October 22 fixes, restrict public access to administrative interfaces, and reset VPN and administrator credentials. They should update Microsoft Authenticator on Android and confirm that managed devices meet the organization’s minimum version. Teams should also inventory PHP and Gotenberg exposure, use CISA’s KEV catalog as a priority input, and check other credible reports of exploitation when setting patch order.
Website operators can check whether public services expose .env files, cloud keys or SSH credentials, and assess automated requests based on verifiable signals rather than a bot’s self-chosen name. Users can avoid bank-app links sent in messages and refuse prompts that ask a PDF reader to launch another program. These steps address the behaviors described in the reports without assuming that every recipient or system was affected.
Further Fortinet technical details are expected on November 10. In the meantime, organizations can act on the available advisories and check their own systems for exposure. Additional information about the scale of the campaigns and the outcomes of the reported attacks may emerge as vendors, researchers and law enforcement publish updates.
Key Questions
Which issue should IT teams address first?
Start by checking whether Fortinet products are exposed and applying the October 22 fixes. The FBI and U.S. Secret Service warning says the password-theft campaign is active. Also prioritize PHP2Shell according to CISA’s catalog and deadline, then assess other exposed or reportedly exploited software, including Gotenberg.
Is MR ROBOT a banking app?
No. CloudSEK describes MR ROBOT as a rented crime kit used to create fake Android banking apps. Its report says the apps can steal one-time codes and forward calls. Users should get bank apps from official app stores rather than links in messages.
What should I do if a PDF asks to launch something?
Decline the prompt, particularly if the PDF was unexpected or claims to be an invoice. Trellix said the reported backdoor activity relied on the recipient accepting the PDF reader’s warning.
Does CISA’s list cover every vulnerability teams should patch?
No. CISA’s Known Exploited Vulnerabilities catalog is a prioritization resource, but the roundup says Gotenberg was absent despite VulnCheck reporting 1,358 exploitation events over 30 days. Teams should consider their exposure and credible reporting beyond the catalog.
Source: Thorsten Meyer AI
