TL;DR
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A roundup dated October 29 highlights six security developments, from Fortinet firewall fixes and an Android banking crime kit to a PDF backdoor and stolen Microsoft Authenticator tokens. The reports point to practical steps, including patching exposed systems, updating the authenticator app and treating CISA’s exploited-vulnerability list as a starting point.
A security roundup published October 29 highlights six developments for businesses and everyday users, including Fortinet firewall fixes, Android malware targeting bank customers, and a flaw that exposed work-account tokens in Microsoft Authenticator on Android. The selected reports recommend immediate steps such as patching internet-facing systems, updating affected apps and refusing suspicious PDF prompts; some activity figures come from the security firms that investigated the threats.
Fortinet issued critical and high-severity fixes for FortiOS, FortiManager and FortiAnalyzer on October 22. The company asked customers to prioritize the changes, while the FBI and U.S. Secret Service said a campaign dubbed FortiBleed, involving password theft from Fortinet firewalls, remained active. Fortinet said technical details of the fixes would be published November 10. Hudson Rock reported finding plain-text passwords in 40,573 records across 1,703 firewall reports; that is the company’s count, not an independently stated estimate of affected organizations.
Two reports focus on mobile devices. CloudSEK described MR ROBOT, an Android crime kit rented by criminals to create fake banking apps that can capture one-time codes and forward calls. CloudSEK said one affiliate was associated with 153 devices and 5,407 text messages. Separately, Enclave researchers reported that another Android app could obtain work-account login tokens from Microsoft Authenticator even with zero permissions. Microsoft addressed the issue as CVE-2026-80097; organizations were advised to update the app and enforce a minimum version.
Trellix traced a backdoor to an empty PDF disguised as a FedEx tax invoice. Its report said the chain depended on a recipient approving a PDF reader’s warning to launch a command. Cequence described a scanner that rotated through about 32 names claiming to represent AI bots while requesting password files and cloud keys. For patch prioritization, CISA added PHP2Shell to its Known Exploited Vulnerabilities catalog on October 26, with a three-day deadline for U.S. federal agencies. VulnCheck separately counted 1,358 attack attempts involving a critical Gotenberg flaw over 30 days; Gotenberg was not on the cited CISA list.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
Six Risks Across Daily Systems
The six reports touch systems people and organizations rely on: firewalls, banking apps, email attachments, authentication software and websites. A firewall password can expose a route into company systems; a fake banking app can capture verification codes; and an authentication flaw can put a work account at risk even when the app making the request has no permissions. The reports describe different attack methods, so one fix will not address all of them.
The roundup’s practical value is its focus on actions readers can take now. Administrators can prioritize patches and limit remote access to management interfaces. Users can install banking apps through trusted app stores and decline prompts to launch commands from unexpected documents. Security teams can also check that automated traffic is verified by more than a self-declared bot name, and consider exploited, internet-facing software that may not yet appear on a government list.
Reported counts help convey what researchers observed, but they do not establish the total number of victims or the likelihood of an attack against a particular reader. Hudson Rock, CloudSEK, Cequence and VulnCheck supplied figures tied to their own investigations. The roundup attributes those numbers rather than treating them as comprehensive measures of exposure.
Products Worth Considering
Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
FLEXISPOT EN1-PRO Electric Standing Desk, 79 x 32, Black Walnut
As an affiliate, we earn on qualifying purchases.
Reports Behind the Weekly Selection
The roundup says it selected six stories from 30 in The Hacker News’ October 29 weekly digest and checked them against original advisories or research reports. Its sources include Fortinet, the FBI and U.S. Secret Service, CloudSEK, Trellix, Enclave, Microsoft, Cequence, CISA and VulnCheck. The mix covers vendor fixes, government guidance and findings by security researchers.
The reports appeared between October 6 and October 28, 2026. Fortinet’s fixes were issued October 22, and the company said it planned to publish more detail on November 10. Microsoft’s advisory identifies the Authenticator issue as CVE-2026-80097. CISA’s catalog entry for PHP2Shell was dated October 26; its three-day remediation deadline applied to U.S. federal agencies, not all organizations.
The roundup’s suggested patch order is to address CISA-listed vulnerabilities first, then assess other flaws known to be exploited and systems exposed to the internet. That is its prioritization advice, rather than a rule attributed to CISA. The reported Gotenberg attempts provide a reason to assess that flaw even though it was absent from the catalog cited in the roundup.
“The company asked customers to treat its October 22 fixes as a priority change.”
— Fortinet
What The Reports Do Not Establish
The cited sources do not provide a shared estimate of how many people or organizations were affected across the six threats. The counts are specific to individual researchers’ datasets or observations: for example, the Gotenberg figure covers attempts recorded by VulnCheck over 30 days, while the CloudSEK device and message counts refer to one affiliate. These figures should not be read as total victim counts.
The roundup does not detail the full technical conditions for every vulnerability or campaign, nor does it establish whether any named reader’s systems were compromised. Fortinet’s planned November 10 disclosure means some technical details of its October 22 fixes were still pending at publication. The supplied material also does not say whether the Gotenberg flaw was later added to CISA’s catalog.
Patch And Disclosure Milestones
Fortinet’s next stated milestone is November 10, when it plans to publish details of the October 22 fixes. Customers can apply the available updates, review remote access to firewall management, and reset VPN and administrator passwords as the roundup recommends. Android users and IT teams can update Microsoft Authenticator and check that managed devices meet a minimum version.
Readers can also take the immediate precautions identified in the reports: install banking apps from trusted sources, refuse unexpected PDF requests to launch commands, and keep secret files out of public web directories. Security teams should review PHP2Shell remediation alongside other exploited and internet-facing vulnerabilities, including the reported Gotenberg issue. Further confirmation about exploitation, affected deployments and vendor or government updates was not included in the roundup.
Key Questions
What are the six security developments in the roundup?
They are Fortinet firewall fixes and an ongoing password-theft campaign, the MR ROBOT Android banking kit, a backdoor delivered through a blank PDF, a Microsoft Authenticator token exposure on Android, a scanner posing as AI bots, and patch-prioritization gaps involving PHP2Shell and Gotenberg.
What should Fortinet customers do?
Apply the available Fortinet fixes, restrict internet access to administrative interfaces, and reset VPN and administrator passwords, as the roundup recommends. Fortinet said more technical detail would be published November 10.
Was Microsoft Authenticator updated to address the Android issue?
Microsoft addressed the issue as CVE-2026-80097. The roundup recommends updating Authenticator and having organizations enforce a minimum app version; it does not specify that version number.
Does CISA’s list include the Gotenberg flaw?
The roundup says Gotenberg was not on the CISA catalog it cited. VulnCheck reported 1,358 attack attempts over 30 days involving the flaw, so the roundup advises teams to assess it alongside catalog-listed vulnerabilities.
Source: Thorsten Meyer AI
