🔍 Read the full analysis: AI And Security: What To Do About This Week’s Firewall Fixes And Stolen Tokens on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Fortinet released security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, while the FBI and Secret Service said a campaign stealing credentials from Fortinet firewalls remained active. Separate reports describe an Android banking-malware kit, a backdoor delivered through a disguised PDF, and a Microsoft Authenticator token exposure that Microsoft has fixed. The reports point to practical steps: patch, rotate exposed credentials, review access and verify suspicious prompts.
Fortinet issued security updates for FortiOS, FortiManager and FortiAnalyzer on October 22 as the FBI and U.S. Secret Service warned that a campaign targeting Fortinet firewalls remained active, making patching and credential checks the immediate priorities for affected organizations. The week’s other reports describe Android banking malware, a backdoor delivered through a disguised PDF and a Microsoft Authenticator token exposure that Microsoft says it has fixed.
Fortinet said its October 22 updates address critical- and high-severity issues in FortiOS, FortiManager and FortiAnalyzer. The company scheduled publication of the related public advisories for November 10. Fortinet said AI-assisted testing contributed to finding issues and credited Anthropic, OpenAI, Google and SpaceX. The company also warned that attackers may use AI tools to analyze patches and develop exploits more quickly, though the advisories’ technical details were not yet public in the source material.
The separate FortiBleed campaign does not depend on the newly patched flaws, according to Fortinet. The FBI and Secret Service cited SOCRadar’s report of more than 86,644 compromised devices across 194 countries. The agencies said attackers use credentials exposed in earlier incidents, weak passwords and password files stored using a legacy method, then create administrator accounts and sell access. The agencies named INC/Lynx and Payload as groups buying access.
Hudson Rock reported on October 27 that it examined 1,703 firewall configuration reports from 1,689 devices and identified 40,573 records containing plaintext passwords. It said those records included 37,076 local-user entries and 1,576 directory-connection account entries; 7,437 local accounts were marked disabled. Hudson Rock cautioned that these are records, not necessarily unique people or working accounts. Other findings in the roundup include CloudSEK’s report of an Android crime kit called MR ROBOT, Trellix’s account of a backdoor hidden in a fake FedEx invoice PDF, and researchers’ report that Microsoft Authenticator on Android could expose work-account login tokens to another app. Microsoft says it fixed the latter issue, listed as CVE-2026-80097.
Infographic 01 · Six stories, six actions
This week in security, in one screen.
Six stories that matter for companies and users, each with the one thing to do. Company figures are the researchers' own counts.
The firewall's own backup file
FortiBleed is still active, says the FBI. Hudson Rock counted 40,573 records with plain-text passwords in 1,703 firewall reports. Fortinet shipped critical fixes on 22 October.
The one actionPatch, take admin logins off the internet, reset VPN and admin passwords.
Bank fraud for rent
MR ROBOT: a rented kit that builds fake bank apps, reads one-time codes and forwards calls. One affiliate: 153 devices, 5,407 texts (CloudSEK’s count).
The one actionNever install a bank app from a link in a message.
The blank invoice
An empty PDF posing as a FedEx tax invoice started a hidden command, but only after the victim approved the PDF reader’s warning.
The one actionIf a PDF asks to launch something, click no.
“I'm Teams,” said the app
An app with zero permissions got work-account tokens from Microsoft Authenticator on Android. Fixed as CVE-2026-80097.
The one actionUpdate Authenticator; enforce a minimum version.
32 fake AI bots
One scanner rotated through about 32 AI-bot names while asking for .env files, cloud keys and SSH keys (Cequence’s count).
The one actionNever serve secret files; verify bots by address, not name.
The list is a floor
PHP2Shell is on CISA’s list. Gotenberg, with 1,358 recorded exploitation events in 30 days (VulnCheck), is not.
The one actionPatch the KEV list first, then exploited and internet-facing.
None of this needed magic. Each attack borrowed trust: a stolen password, a click, a name, a text message.Thorsten Meyer · my reading
Sources: Fortinet, 21 Oct 2026 · FBI and USSS, 6 Oct 2026 · Hudson Rock, 27 Oct 2026 · CloudSEK, 28 Oct 2026 · Trellix, 26 Oct 2026 · Enclave, 23 Oct 2026 · Microsoft, CVE-2026-80097 · Cequence, 28 Oct 2026 · CISA KEV, catalog 2026.10.28 · VulnCheck, 26 Oct 2026. Selection and wording: Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Firewall Access Needs Review
Firewalls sit at the boundary of company networks, so compromised administrator access can give intruders a foothold that reaches beyond a single device. The FortiBleed reporting describes a route based on reused or weak credentials, rather than a new Fortinet software flaw. That distinction matters: installing the latest updates does not by itself remove an attacker’s existing account or invalidate a stolen password.
The other reports show how routine workflows can expose sensitive access. A user who accepts an unexpected PDF-reader warning may allow a malicious document to run; a mobile banking victim may lose one-time codes or have calls forwarded; and a login token can grant access without the attacker needing to know the password. The common thread is not one technology, but the need to check both software and the credentials and permissions around it.
For organizations, the practical response is to prioritize vendor updates while also checking for unfamiliar firewall administrators, rotating credentials that may have been exposed, and reviewing multi-factor authentication. Individuals should avoid approving unexpected prompts, install app and operating-system updates, and contact their bank through a trusted channel if they suspect a fake banking app. These steps address the reported risks without assuming every system has been compromised.
Popular right now
Vitamix Propel Series 510 Professional-Grade Blender, 3 Programs, Black
Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black
Ninja Flip Toaster Oven and Air Fryer, 8-in-1, Stainless Steel, SP151
As an affiliate, we earn on qualifying purchases.
How This Week’s Reports Connect
The roundup, published by ThorstenMeyerAI.com on October 29, selected six stories from a 30-item weekly digest by The Hacker News and said it checked the original advisories or research reports. The source notes that many figures come from security companies that also sell protective products, so company counts should be read with their stated methods and limitations.
Fortinet’s October updates followed earlier updates for FortiMail and FortiAuthenticator. Its FortiBleed campaign warning is a distinct development: the company said the campaign was not caused by a new Fortinet vulnerability, but by credential reuse and weak-password attacks. The FBI and Secret Service issued their joint warning on October 6, and Hudson Rock published its analysis of configuration reports on October 27.
The roundup also cited a separate vulnerability-prioritization issue. CISA gave U.S. federal agencies three days to address PHP2Shell, while VulnCheck reported 1,358 recorded attack attempts against a critical Gotenberg flaw over 30 days. The source says Gotenberg was not on CISA’s Known Exploited Vulnerabilities catalog at the time. That contrast underscores that an official must-fix list is a useful baseline, not a complete inventory of every risk an organization may need to assess.
“FortiBleed “is not a new Fortinet vulnerability.””
— Fortinet
What the Counts Do Not Show
The public Fortinet advisories were scheduled for November 10, so the specific vulnerabilities, affected versions and recommended fixes were not detailed in the supplied material. It is also not clear how many devices in the campaign remain compromised, how many reported credentials are still valid, or how many organizations have installed the October updates.
The figures come from different researchers and describe different things: compromised devices, configuration reports, password records and recorded attack attempts. They should not be added together or treated as a direct measure of current victims. The supplied material gives only limited technical detail on MR ROBOT and the PDF backdoor, and does not state how many people were affected. Microsoft’s fix is reported, but the source does not specify the release date or whether all vulnerable installations have been updated.
Patch, Audit and Recheck Access
Organizations using FortiOS, FortiManager or FortiAnalyzer should review Fortinet’s October 22 update guidance, apply the relevant fixes and check the November 10 advisories for technical detail. Security teams should separately review firewall administrator accounts, rotate credentials that may have been exposed, remove accounts no longer needed and confirm that multi-factor authentication is enabled. A patch does not by itself establish that a device was never accessed.
Teams should also review their own exposure rather than rely only on a public priority list: check whether affected document or gateway software is in use, monitor for unexpected authentication activity, and verify that mobile authentication apps are current. Individuals should use official app stores and bank contact details, and treat an unexpected request to allow a document action or approve a login as a reason to stop and verify. More detail will depend on the forthcoming Fortinet advisories and follow-up reporting from the researchers and agencies.
Key Questions
Are the Fortinet updates and FortiBleed the same issue?
No. Fortinet’s October 22 updates address software vulnerabilities, while Fortinet said the FortiBleed campaign relies on stolen or weak credentials and is not a new Fortinet vulnerability. Organizations should address both software updates and account security.
What should a Fortinet customer do first?
Check Fortinet’s guidance for the products and versions in use, apply relevant October updates, and review firewall accounts and credentials. Consult the November 10 advisories for the scheduled public technical details.
Do the reported 40,573 password records mean that many people were hacked?
No. Hudson Rock counted records in configuration reports, not unique people or confirmed active accounts. It also said some records were disabled and not all passwords would still work.
Has Microsoft fixed the Authenticator token issue?
The source material says Microsoft fixed the Android issue, identified as CVE-2026-80097. It does not specify the fix’s release date or whether every affected device has been updated, so users should check for app and system updates.
Does appearing on CISA’s list cover every urgent vulnerability?
No. The roundup describes the CISA Known Exploited Vulnerabilities catalog as a prioritization resource, but says a Gotenberg flaw with reported attack attempts was not listed. Organizations should use the catalog alongside vendor advisories and their own exposure checks.
Source: ThorstenMeyerAI.com
