TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A weekly security review selected six developments from 30 stories, including active Fortinet firewall threats, rented Android banking malware and a fixed Microsoft Authenticator flaw. The sources describe risks involving exposed systems, stolen credentials and user trust; several reported attack counts come from security companies and have limited context.
Fortinet released critical and high-severity fixes for FortiOS, FortiManager and FortiAnalyzer on October 22. The FBI and U.S. Secret Service have warned that a campaign dubbed “FortiBleed,” involving theft of firewall passwords, remains active, according to the roundup. Fortinet has scheduled publication of further vulnerability details for November 10. Hudson Rock reported finding 40,573 records with plaintext passwords in 1,703 firewall reports; those figures are the company’s own counts.
CloudSEK described MR ROBOT, an Android crime kit rented to criminals to create fake banking apps. The kit can steal one-time codes and forward calls, the researchers said. CloudSEK reported that one affiliate’s activity involved 153 devices and 5,407 text messages. Separately, Trellix traced a backdoor to an empty PDF disguised as a FedEx tax invoice. The attack required the user to approve a warning in the PDF reader, according to Trellix.
Researchers at Enclave reported that another Android app, despite having no permissions, could trick Microsoft Authenticator into providing work-account login tokens. Microsoft fixed the issue, identified as CVE-2026-80097. The roundup also cited Cequence’s report of a scanner rotating among about 32 purported AI-bot identities while requesting sensitive files and keys. On patch priorities, CISA gave U.S. federal agencies three days to address PHP2Shell after adding it to its Known Exploited Vulnerabilities catalog. VulnCheck counted 1,358 attempted exploits of a critical Gotenberg flaw in a 30-day period; Gotenberg was not on that catalog at the time cited.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
Risks Across Business and Personal Devices
The six reports point to exposure across network gateways, phones, email and websites. A compromised firewall can put business access at risk, while stolen authentication tokens may let an attacker use a work account. Fake banking apps target customers directly, and a malicious document can rely on a person approving a security prompt.
The roundup’s practical recommendations focus on reducing those openings: apply relevant fixes, limit internet access to administrative interfaces, reset potentially exposed credentials, keep authentication apps current and treat unexpected prompts as a warning. For web operators, the report says to protect secret files and verify automated traffic by technical indicators such as source address rather than trusting a bot’s claimed name.
Products Worth Considering
Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
As an affiliate, we earn on qualifying purchases.
Six Stories From a Weekly Digest
The source article says The Hacker News published 30 security stories in its October 29 weekly digest. Its author selected six for businesses and ordinary users, saying each was checked against the original advisory or research report. The article notes that many figures came from security vendors or researchers that also sell security products, and identifies company counts as such.
The roundup groups the incidents around several recurring weaknesses: internet-facing logins, old or stolen passwords, a user approving a prompt, and software trusting another app’s identity. It presents the figures as observations from named sources, not as independently established totals or comparable measures of risk.
Details and Counts Still Developing
Fortinet’s additional technical details are scheduled for November 10, so the full scope of the October 22 fixes and the campaign’s relationship to specific vulnerabilities remains unclear from the material provided. The source also does not establish how many organizations or individuals have been affected across the six developments.
Several numbers are attributed to company research, including Hudson Rock’s password records, CloudSEK’s device and text counts, Cequence’s bot identities and VulnCheck’s Gotenberg attempts. The roundup does not provide the underlying datasets or a common method for comparing those counts. It also does not say whether the reported attempts resulted in successful compromises.
Patch Updates and Further Advisories
Fortinet’s next stated milestone is publication of additional details on November 10. Organizations using the affected Fortinet products should review the vendor’s advisories and apply the fixes that match their systems. The source recommends removing administrative access from the public internet and resetting VPN and administrator passwords where exposure is a concern.
Users should update Microsoft Authenticator and install banking apps only through trusted app stores or official bank channels. Security teams can check CISA’s KEV catalog, then assess other exploited and internet-facing software, including Gotenberg. The material does not identify further dates for updates on the Android crime kit, PDF backdoor or scanner activity.
Key Questions
Which Fortinet products received fixes?
Fortinet released critical and high-severity fixes for FortiOS, FortiManager and FortiAnalyzer on October 22, according to the roundup. Further details are scheduled for November 10.
What does the MR ROBOT Android kit do?
CloudSEK said criminals can rent MR ROBOT to create fake banking apps that steal one-time codes and secretly forward calls. The report recommends avoiding bank app links sent in messages.
Has Microsoft fixed the Authenticator issue?
Yes. The flaw involving Microsoft Authenticator on Android was identified as CVE-2026-80097, and Microsoft has fixed it, according to the source material. Users should update the app.
Does the Gotenberg count mean 1,358 successful attacks?
No. VulnCheck reported 1,358 recorded attack attempts over 30 days. The roundup does not say those attempts resulted in successful compromises.
Source: Thorsten Meyer AI
