Threat reportVulnerabilityTL-2026-4771
ThreatsDay Bulletin: Fortinet Critical Firewall Updates (Details Embargoed), Gotenberg RCE CVE-2026-42589 Under Active Exploitation, PHP2Shell Scanning
ThreatsDay Bulletin (TL-2026-4771), also tracked as PHP2Shell, is a critical-severity software vulnerability, first published 2026-10-29. It has no confirmed attribution, affects Gotenberg Gotenberg, references 6 CVEs (CVE-2026-42589, CVE-2026-109618, CVE-2026-109619), maps to 13 MITRE ATT&CK techniques (T1033, T1059, T1059.004), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 6Referenced vulnerabilities
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-4771
- Threat ID
- TL-2026-4771
- Also known as
- PHP2Shell, cache_base campaign
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, web hosting, manufacturing, health, professional services, network infrastructure
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in ThreatsDay Bulletin
Malware and tooling: PHP, The Gentlemen ransomware, cache_base, JuicyPotatoNG, Mirai, RegPwn
How ThreatsDay Bulletin works
The Hacker News ThreatsDay bulletin (2026-10-29) reports embargoed Critical/High Fortinet updates for FortiOS, FortiManager and FortiAnalyzer (advisories due 2026-11-10), active exploitation of Gotenberg RCE CVE-2026-42589 (CVSS 9.8; 1,358 events from 128 unique IPs in 30 days, including delivery of a custom Go reverse shell 'cache_base'), and ongoing PHP2Shell scanning against PHP RCE CVE-2026-109618/CVE-2026-109619 (CVSS v4.0 9.2).
This record consolidates the high-severity items in The Hacker News ThreatsDay bulletin of 2026-10-29, cross-checked against primary and secondary sources.
Gotenberg (CVE-2026-42589, CVSS 9.8): Gotenberg, a Docker-powered PDF API, is vulnerable before 8.31.0 to unauthenticated remote code execution through the /forms/pdfengines/metadata/write endpoint. The endpoint forwards JSON metadata keys to ExifTool without validation; a newline character inside a JSON key breaks the ExifTool argument stream and lets an attacker inject parameters such as -if, which evaluates Perl expressions and yields OS command execution. The server still returns HTTP 200 and a valid PDF, so the exploit produces no error signal. The default Docker image runs the process as uid 1001 with root group membership. Public exploit code exists. VulnCheck reports 1,358 exploitation events from 128 unique source IPs over 30 days (Great Britain 1,127 events, Israel 224), spanning commodity scanners, cryptominers and custom backdoor deployment. In early October 2026 VulnCheck observed an actor on a residential Japanese IP (210.170.22.208) deliver 'cache_base', a 5.2 MB stripped, statically linked Go 1.22.2 ELF x86-64 reverse shell, from three payload mirrors (GitHub raw, a self-hosted Gitea on Alibaba Cloud, and a dynamic-DNS host). The exploit chain runs 'id' with output to /tmp/nx_cmd.txt, retrieves it via ExifTool, then tries wget, curl and a Node.js fetch fallback to download the payload. cache_base has no persistence of its own; the related infrastructure also hosted a 'pull' downloader, a 'temp' watchdog, JuicyPotatoNG, RegPwn, a PHP webshell and CMS plugin packages. Latest observed activity was 2026-10-20.
PHP2Shell (CVE-2026-109618, CVE-2026-109619; CVSS v4.0 9.2): Two unauthenticated RCE flaws in PHP 8.2-8.5. CVE-2026-109618 is memory corruption triggered by an out-of-memory condition (longjmp leaves request data partially initialized and cleanup then operates on invalid data). CVE-2026-109619 is use of stale global state across requests (confirmed paths: session.upload_progress and the PHP 8.5 fatal error backtrace feature). Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Amazon honeypots recorded exploitation attempts on 2026-10-17, four days before the 2026-10-21 patches. Cloudflare reported attempts rising from tens of thousands to millions within a day of disclosure, including Mirai-variant deployment. Wordfence reports ongoing scanning and exploitation attempts across more than 5 million protected sites but, as of 2026-10-28, was not aware of any WordPress site compromised through PHP2Shell.
Fortinet: On 2026-10-21 Fortinet's CISO announced coordinated updates, released 2026-10-22, for FortiOS (8.0.2, 7.6.8, 7.4.13, 7.2.14), FortiManager and FortiAnalyzer (8.0.2, 7.6.8, 7.4.12, 7.2.13) fixing Critical/High flaws found through AI-assisted security testing. CVE identifiers, CVSS and technical details are embargoed until 2026-11-10; none are stated and none are invented here. Defenders should patch now.
Other bulletin items: CVE-2025-70795 (Safetica ProcessMonitorDriver 11.26.18, abused with Lenovo BootRepair.sys 2.5.30.11281) is used by The Gentlemen ransomware EDR killer to terminate security processes (BYOVD), per Acronis. CVE-2026-80097 ('AuthMask') is an Android Microsoft Authenticator token-theft flaw (Enclave.ai). CVE-2026-93348 (CVSS 8.6) is code execution in the Unsloth model loader, fixed in unsloth_zoo 2026.8.14 (Pillar Security). The bulletin also notes an open directory at 185.157.161.148 tied to n0n ransomware tooling (23+ victims across 14 countries). The CVSS score is left null because the bulletin covers multiple issues with differing scores.
MITRE ATT&CK techniques used in TL-2026-4771
Discovery
T1033 System Owner/User Discovery
Execution
T1059 Command and Scripting Interpreter; T1059.004 Unix Shell; T1569.002 Service Execution
Command and Control
Initial Access
T1190 Exploit Public-Facing Application
defense-impairment
T1484.001 Group Policy Modification; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Impact
Persistence
Reconnaissance
T1595.002 Vulnerability Scanning
Resource Development
Affected products and versions in ThreatsDay Bulletin
- Gotenberg — Gotenberg
Vulnerable versions: < 8.31.0
Fixed in: 8.31.0 - PHP Group — PHP
Vulnerable versions: 8.2; 8.3; 8.4; 8.5
Fixed in: 8.5.12; 8.4.27; 8.3.36; 8.2.35 - Fortinet — FortiOS
Vulnerable versions: Details embargoed until 2026-11-10
Fixed in: 8.0.2; 7.6.8; 7.4.13; 7.2.14 - Fortinet — FortiManager / FortiAnalyzer
Vulnerable versions: Details embargoed until 2026-11-10
Fixed in: 8.0.2; 7.6.8; 7.4.12; 7.2.13 - Safetica — ProcessMonitorDriver (CVE-2025-70795)
Vulnerable versions: 11.26.18 - Lenovo — BootRepair.sys (abused by Gentlemen EDR killer)
Vulnerable versions: 2.5.30.11281 - Unsloth — unsloth_zoo (CVE-2026-93348)
Vulnerable versions: < 2026.8.14
Fixed in: 2026.8.14
Remediation for ThreatsDay Bulletin
Patches
- Gotenberg 8.31.0
- PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
- FortiOS 8.0.2, 7.6.8, 7.4.13, 7.2.14
- FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12, 7.2.13
- unsloth_zoo 2026.8.14
Immediate actions
- Upgrade Gotenberg to 8.31.0 or later; isolate or take offline any internet-exposed Gotenberg instance running an older version
- Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately and audit logs for the exposure window starting 2026-10-17
- Apply the 2026-10-22 Fortinet updates to FortiOS, FortiManager and FortiAnalyzer without waiting for the 2026-11-10 advisories
- Block and hunt for the network IOCs and cache_base artifacts listed in this record
Workarounds
- PHP: set session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0; limit decoded request size, input field count, multipart parts and nesting depth (no complete interim mitigation exists)
- Gotenberg: block or authenticate access to /forms/pdfengines/metadata/write at a reverse proxy
Longer-term hardening
- Do not expose document-conversion services such as Gotenberg directly to the internet; restrict to trusted networks
- Run containerized services as non-root with read-only filesystems and egress filtering
- Enable driver blocklisting (Microsoft vulnerable driver blocklist / HVCI) and EDR tamper protection against BYOVD
- Monitor PHP worker crashes and child process spawning with auditd, Falco or Sysmon
CVEs associated with ThreatsDay Bulletin
CVE-2026-42589, CVE-2026-109618, CVE-2026-109619, CVE-2026-80097, CVE-2025-70795, CVE-2026-93348
Weaknesses (CWE) in ThreatsDay Bulletin
Timeline of ThreatsDay Bulletin
- Gotenberg 8.31.0 fixes CVE-2026-42589 (patched May 2026 per VulnCheck via The Hacker News; vuln.today groups the Gotenberg advisories under 2026-05-07)
- Self-hosted Gitea instance used to serve cache_base payloads established (VulnCheck)
- Amazon honeypots record first PHP2Shell exploitation attempts, four days before patches
- PHP2Shell disclosure accelerated after an information leak; latest observed Gotenberg cache_base activity from 210.170.22.208
- PHP releases 8.5.12/8.4.27/8.3.36/8.2.35; Fortinet CISO announces coordinated security updates with details embargoed
- Fortinet releases FortiOS, FortiManager and FortiAnalyzer fixes; Cloudflare sees PHP2Shell attempts climb into the millions
- Wordfence reports ongoing PHP2Shell scanning across 5M+ sites but no known WordPress compromise
- The Hacker News ThreatsDay bulletin reports Gotenberg exploitation (1,358 events, 128 IPs over 30 days), PHP2Shell scanning and Fortinet embargo
- Scheduled date for Fortinet to publish CVE details and advisories for the embargoed FortiOS/FortiManager/FortiAnalyzer flaws
Sources cited for ThreatsDay Bulletin
- ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
- VulnCheck: Cache Me If You Can (Gotenberg CVE-2026-42589 exploitation, cache_base)
- Averlon: CVE-2026-42589 Gotenberg Unauthenticated RCE via ExifTool Metadata Key Injection
- Vulert: CVE-2026-42589 Gotenberg Unauthenticated RCE
- Picus: PHP2Shell - Two Critical PHP RCE Flaws Explained
- BleepingComputer: Amazon says PHP2Shell exploitation began 4 days before patches
- BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws
- Tanium: PHP2Shell - Responding to CVE-2026-109618 and CVE-2026-109619
- Fortinet CISO Collective: Security Hardening Release for Multiple Products
- Help Net Security: Fortinet patches critical FortiOS flaws found with AI help
- Acronis TRU: The Gentlemen - a closer look at a not-so-gentle RaaS operation
Detection coverage for TL-2026-4771
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4771 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.