TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
This week’s security roundup selects six stories from The Hacker News’ 30-item digest and checks them against advisories and research reports. The developments include Fortinet firewall fixes, Android banking malware offered for rent, a backdoor delivered through a deceptive PDF and a flaw in Microsoft Authenticator for Android that Microsoft says it has fixed.
A security roundup published on October 29 highlights six developments for businesses and individual users, including Fortinet firewall fixes, rented Android banking malware and a Microsoft Authenticator flaw that Microsoft says it has fixed. The report, by Thorsten Meyer AI, says it selected the stories from a 30-item weekly digest by The Hacker News and checked them against original advisories and research reports.
Fortinet shipped critical and high-severity fixes for FortiOS, FortiManager and FortiAnalyzer on October 22. The roundup says Fortinet asked customers to prioritize the change, while the FBI and US Secret Service warned that the FortiBleed password-theft campaign targeting Fortinet firewalls remained active. Details of the fixes are scheduled to become public on November 10. The article also cites Hudson Rock’s count of 40,573 records containing plain-text passwords across 1,703 firewall reports; those figures are attributed to the company.
CloudSEK reported on October 28 that an Android crime kit called MR ROBOT is rented to criminals and can be used to build fake banking apps. The kit can steal one-time codes and forward calls, according to the report. CloudSEK also counted one affiliate using the kit on 153 devices and sending 5,407 text messages. Separately, Trellix said an empty PDF disguised as a FedEx tax invoice could deliver a hidden backdoor if a person approved a warning from the PDF reader.
Researchers at Enclave reported that another Android app with zero permissions could be used to obtain work-account login tokens from Microsoft Authenticator. Microsoft says it fixed the issue, listed as CVE-2026-80097. Cequence reported that one scanner used about 32 different names claiming to identify AI bots while requesting password files and cloud keys. For patch planning, the roundup contrasts PHP2Shell, which CISA added to its Known Exploited Vulnerabilities catalog, with a critical Gotenberg flaw that VulnCheck recorded 1,358 exploitation attempts against in 30 days.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
Where the Six Risks Converge
The incidents touch firewalls, phones, email and web servers, but the reported attack paths rely on familiar weaknesses: exposed administrative access, stolen credentials, a person approving a prompt, or software trusting another program’s identity. That makes the roundup relevant to both IT teams responsible for internet-facing systems and individuals who use banking and authentication apps.
The figures are useful signals, but their limits matter. The password records, infected-device count, bot identities and Gotenberg attempts come from security researchers or companies, not a single independently audited tally of harm. They describe what those sources observed; they do not establish how many organizations were compromised or how much financial loss occurred. The practical value of the roundup is its focus on concrete steps tied to each report, such as patching, limiting administrative exposure and refusing unexpected prompts.
Products Worth Considering
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Ledger Flex + Folio Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
From Weekly Digest to Actions
The article says The Hacker News published a 30-story weekly digest on October 29. Meyer selected six items, revisited the original advisory or research report for each, and paired them with an action for readers. The coverage spans reports dated October 21 through October 28, as well as the October 22 Fortinet fixes and CISA’s catalog entry for PHP2Shell.
Those sources include vendors and security firms that investigate threats and may also sell protective services. The article says it attributes company counts to the companies that produced them. CISA’s Known Exploited Vulnerabilities catalog provides a federal patch-prioritization reference; the roundup argues that teams should also consider exploited and internet-facing software that is not listed there.
“The list is a floor, not a ceiling.”
— Thorsten Meyer AI
What the Reports Do Not Establish
The roundup does not state how many organizations or people were successfully affected by the six developments, or whether the cited activity caused confirmed financial losses. It also does not provide the underlying records behind the researchers’ counts, so their methods and coverage cannot be assessed from the article alone. The reported Gotenberg figure is a count of recorded exploitation attempts, not a confirmed victim count.
Fortinet’s fixes were available by the report’s publication date, but the article says further vulnerability details would not be published until November 10. The summary does not give the affected versions or describe the full conditions for exploitation. It also does not specify the minimum safe Microsoft Authenticator version or provide a complete list of affected configurations.
Patch and Monitor the Systems
The report recommends that organizations apply Fortinet’s updates, remove administrative logins from public internet access and reset VPN and administrator passwords. Users should install banking apps only through trusted app stores or official bank channels, and decline a PDF reader prompt that asks to launch something unexpectedly. IT teams should update Microsoft Authenticator and enforce a minimum version, while web operators should prevent secret files from being served and check bot claims against network addresses.
For patch planning, the roundup advises fixing CISA-listed vulnerabilities such as PHP2Shell, then reviewing other exploited and internet-facing software, including Gotenberg. Teams can watch for Fortinet’s scheduled November 10 disclosure for more detail on the October fixes. The article does not identify a further milestone for the other reports; organizations will need to follow updates from the cited vendors, researchers and government agencies.
Key Questions
What are the six security developments in the roundup?
They cover Fortinet firewall updates and an ongoing password-theft campaign, rented Android banking malware, a backdoor delivered through a deceptive PDF, a Microsoft Authenticator issue on Android, a scanner posing as AI bots, and patch priorities involving PHP2Shell and Gotenberg.
Has Microsoft fixed the Authenticator issue?
The article says Microsoft fixed the Android issue listed as CVE-2026-80097. It recommends updating Authenticator and having IT teams enforce a minimum app version, but the article does not specify that version.
When will more details about the Fortinet fixes be available?
The article says Fortinet scheduled publication of the details for November 10, 2026. It reports that the updates shipped on October 22 and that the FBI and U.S. Secret Service described the FortiBleed campaign as active.
Does the Gotenberg figure mean 1,358 systems were compromised?
No. The roundup attributes 1,358 recorded exploitation attempts in 30 days to VulnCheck. It does not report that this number represents distinct victims or confirmed compromises.
Source: Thorsten Meyer AI
