AI And Security Operations: Responding To This Week’s Threats

🔍 Read the full analysis: AI And Security Operations: Responding To This Week’s Threats on ThorstenMeyerAI.com

ThorstenMeyerAI.com published a six-item security roundup on October 29, highlighting active attacks against Fortinet firewalls, Android banking malware, a backdoor delivered through a disguised PDF, an Android authentication-token flaw, automated bot impersonation, and patch-priority gaps. The report urges businesses to prioritize exposed systems and account security, while warning that its attack counts largely come from the security firms that investigated them.

The most urgent infrastructure issue in the roundup is the FortiBleed campaign. The FBI and U.S. Secret Service warned on October 6 that attacks against Fortinet firewalls remained active. Their advisory cites SOCRadar, which reported verifying more than 86,644 compromised devices across 194 countries. The roundup says attackers reuse previously leaked credentials, guess weak passwords and exploit password files stored using a legacy method. They may create administrator accounts and sell access to other criminal groups.

That figure is an attributed estimate, not an independently established count of current victims. A separate Hudson Rock analysis, published October 27, examined 1,703 firewall configuration reports from 1,689 devices and counted 40,573 records containing plaintext passwords. Hudson Rock said those records were not equivalent to people or necessarily active accounts; 7,437 local accounts were marked disabled. Fortinet has said FortiBleed is not a new product vulnerability and has linked the campaign to reused credentials and weak passwords without multifactor authentication.

Separately, Fortinet released coordinated updates for FortiOS, FortiManager and FortiAnalyzer on October 22, including critical- and high-severity fixes. The public advisories were scheduled for November 10. The company said AI-assisted testing contributed to identifying issues and warned that attackers may be able to study patches and develop exploits faster. The roundup also covers a rented Android crime kit called MR ROBOT, a malicious blank PDF disguised as a FedEx tax invoice, a fixed Microsoft Authenticator issue, a scanner using fake AI-bot identities, and a gap between CISA’s must-patch list and other reported risks.

Firewall Exposure Tops This Week’s Risks

The firewall reporting matters because these devices sit at the boundary between company networks and the public internet. Compromised administrator access can give attackers a foothold and, according to the federal advisory cited in the roundup, can be sold onward. Reviewing firewall access is not just a matter of applying a new software fix: organizations also need to check whether credentials have been reused, whether accounts are still required, and whether multifactor authentication is enabled.

The other items show how security failures can arise at different points in ordinary workflows. CloudSEK described MR ROBOT as a rented crime kit for building fake banking apps that can steal one-time codes and forward calls. Trellix said a concealed backdoor was delivered through an empty PDF made to resemble a FedEx tax invoice; its account says the infection depended on a user accepting a PDF reader warning. These reports highlight the value of verifying unexpected files and avoiding approval prompts that are not understood.

For defenders, the roundup also cautions against relying on a single checklist. CISA’s Known Exploited Vulnerabilities catalog is a useful federal prioritization tool, but the report says a critical Gotenberg flaw was not listed there despite VulnCheck recording 1,358 attack attempts over 30 days. The figure is attributed to VulnCheck; the roundup does not provide enough detail to treat it as a count of successful intrusions. Security teams may need to combine official catalogs with vendor advisories and threat research.

Popular right now

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Breville Bambino Espresso Machine, Brushed Stainless Steel (BES450BSS)

AmazonView Latest Price

Dyson V8 Cyclone Cordless Vacuum

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

Six Reports, Different Attack Paths

The article frames its selection as a focused alternative to a weekly digest of 30 stories published by The Hacker News. It says it selected six developments it judged relevant to businesses and ordinary users and checked the original advisories or research reports. The stories span perimeter devices, smartphones, email-like document lures, automated internet scanning and vulnerability prioritization.

The roundup distinguishes the Fortinet credential campaign from the company’s October 22 software updates. The FBI and Secret Service warning concerns attackers using credentials and weak authentication; Fortinet’s separate updates address security flaws in several products. The company said the public details for those fixes would come on November 10. The roundup also notes that Fortinet credited Anthropic, OpenAI, Google and SpaceX for assistance with AI-supported testing.

In the mobile-security item, researchers reported that an Android app with no permissions could be tricked into obtaining work-account login tokens associated with Microsoft Authenticator. Microsoft has fixed the issue, identified as CVE-2026-80097, according to the source material. Another item attributes to Cequence the observation of one scanner rotating through about 32 false AI-bot identities while requesting password files and cloud keys. The number describes that scanner’s reported behavior, not the overall scale of such activity.

„FortiBleed “is not a new Fortinet vulnerability.”“

— Fortinet

Counts Do Not Equal Confirmed Victims

The source material does not establish how many Fortinet devices remain compromised or how many of the password records Hudson Rock found correspond to active accounts. The 86,644-device figure is attributed to SOCRadar through the federal advisory, while Hudson Rock explicitly cautioned that its records were not a count of people and included disabled accounts. Fortinet disputes that FortiBleed represents a new vulnerability, but the roundup does not provide a full independent technical assessment of every compromised device.

Details of Fortinet’s October 22 fixes were due to become public on November 10, so the supplied report does not identify each vulnerability or affected version. It also does not establish how many users were affected by the Microsoft Authenticator issue or whether the Gotenberg attack attempts resulted in successful compromises. For the other reports, the roundup summarizes researchers’ findings but does not give independently verified victim totals.

Patch, Review, Then Recheck

Organizations using FortiOS, FortiManager or FortiAnalyzer should review Fortinet’s updates and advisories, apply relevant fixes, and reassess their exposure when the public details are released on November 10. For the FortiBleed campaign, the roundup recommends reviewing firewall accounts and configurations, replacing reused or weak passwords, enabling multifactor authentication and checking for unexpected administrator accounts. It also advises treating configuration backups as sensitive because they may contain credentials.

Security teams should verify whether they use the affected Microsoft Authenticator Android version and confirm that Microsoft’s fix is in place. They can also review exposure to Gotenberg and PHP2Shell, comparing vendor guidance and threat intelligence with CISA’s Known Exploited Vulnerabilities catalog rather than treating that catalog as an exhaustive list. The source says CISA gave U.S. federal agencies three days to address PHP2Shell; it does not provide a corresponding deadline for Gotenberg.

For individual users, the roundup’s immediate precautions are to avoid installing banking apps from links in unsolicited messages, verify unexpected invoices through a separate channel, and stop when a document reader or phone asks for an unfamiliar permission or approval. The available reports do not establish the total reach of the threats. Further vendor advisories, agency updates and research may clarify affected products, successful intrusions and the scale of impact.

Key Questions

What is the main development in this security roundup?

ThorstenMeyerAI.com published a report on October 29 selecting six security developments, including an active campaign targeting Fortinet firewall credentials and several threats affecting phones, documents and internet-facing software.

Does FortiBleed mean Fortinet has disclosed a new vulnerability?

Not according to Fortinet, which said the campaign is not a new Fortinet vulnerability. The roundup describes attackers reusing leaked credentials, guessing weak passwords and targeting firewall access. Fortinet also issued separate product updates on October 22.

How many devices were reported compromised in the FortiBleed campaign?

The federal advisory cited SOCRadar as verifying more than 86,644 compromised devices across 194 countries. This is an attributed research estimate, not a confirmed count of current victims. Hudson Rock’s separate password-record analysis also included records for disabled accounts.

Has the Microsoft Authenticator Android issue been fixed?

Microsoft has fixed the issue identified as CVE-2026-80097, according to the roundup. The report does not say how many accounts were affected; organizations should check Microsoft’s guidance and confirm their software is updated.

Why does the article say CISA’s patch list may not be enough?

The roundup says a critical Gotenberg flaw was not on CISA’s Known Exploited Vulnerabilities catalog, while VulnCheck recorded 1,358 attack attempts over 30 days. That figure is attributed to VulnCheck and does not establish successful compromises. The point is to review vendor advisories and other research alongside CISA’s list.

Source: ThorstenMeyerAI.com