# ThreatsDay Bulletin: Fortinet Critical Firewall Updates (Details Embargoed), Gotenberg RCE CVE-2026-42589 Under Active Exploitation, PHP2Shell Scanning

> The Hacker News ThreatsDay bulletin (2026-10-29) reports embargoed Critical/High Fortinet updates for FortiOS, FortiManager and FortiAnalyzer (advisories due 2026-11-10), active exploitation of Gotenberg RCE CVE-2026-42589 (CVSS 9.8; 1,358 events from 128 unique IPs in 30 days, including delivery of a custom Go reverse shell 'cache_base'), and ongoing PHP2Shell scanning against PHP RCE CVE-2026-109618/CVE-2026-109619 (CVSS v4.0 9.2).

- **Published:** 2026-10-29T21:13:29Z
- **Last reviewed:** 2026-10-29T21:13:29Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4771
- **ID:** TL-2026-4771
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-42589, CVE-2026-109618, CVE-2026-109619, CVE-2026-80097, CVE-2025-70795, CVE-2026-93348

## Description

This record consolidates the high-severity items in The Hacker News ThreatsDay bulletin of 2026-10-29, cross-checked against primary and secondary sources.

Gotenberg (CVE-2026-42589, CVSS 9.8): Gotenberg, a Docker-powered PDF API, is vulnerable before 8.31.0 to unauthenticated remote code execution through the /forms/pdfengines/metadata/write endpoint. The endpoint forwards JSON metadata keys to ExifTool without validation; a newline character inside a JSON key breaks the ExifTool argument stream and lets an attacker inject parameters such as -if, which evaluates Perl expressions and yields OS command execution. The server still returns HTTP 200 and a valid PDF, so the exploit produces no error signal. The default Docker image runs the process as uid 1001 with root group membership. Public exploit code exists. VulnCheck reports 1,358 exploitation events from 128 unique source IPs over 30 days (Great Britain 1,127 events, Israel 224), spanning commodity scanners, cryptominers and custom backdoor deployment. In early October 2026 VulnCheck observed an actor on a residential Japanese IP (210.170.22.208) deliver 'cache_base', a 5.2 MB stripped, statically linked Go 1.22.2 ELF x86-64 reverse shell, from three payload mirrors (GitHub raw, a self-hosted Gitea on Alibaba Cloud, and a dynamic-DNS host). The exploit chain runs 'id' with output to /tmp/nx_cmd.txt, retrieves it via ExifTool, then tries wget, curl and a Node.js fetch fallback to download the payload. cache_base has no persistence of its own; the related infrastructure also hosted a 'pull' downloader, a 'temp' watchdog, JuicyPotatoNG, RegPwn, a PHP webshell and CMS plugin packages. Latest observed activity was 2026-10-20.

PHP2Shell (CVE-2026-109618, CVE-2026-109619; CVSS v4.0 9.2): Two unauthenticated RCE flaws in PHP 8.2-8.5. CVE-2026-109618 is memory corruption triggered by an out-of-memory condition (longjmp leaves request data partially initialized and cleanup then operates on invalid data). CVE-2026-109619 is use of stale global state across requests (confirmed paths: session.upload_progress and the PHP 8.5 fatal error backtrace feature). Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Amazon honeypots recorded exploitation attempts on 2026-10-17, four days before the 2026-10-21 patches. Cloudflare reported attempts rising from tens of thousands to millions within a day of disclosure, including Mirai-variant deployment. Wordfence reports ongoing scanning and exploitation attempts across more than 5 million protected sites but, as of 2026-10-28, was not aware of any WordPress site compromised through PHP2Shell.

Fortinet: On 2026-10-21 Fortinet's CISO announced coordinated updates, released 2026-10-22, for FortiOS (8.0.2, 7.6.8, 7.4.13, 7.2.14), FortiManager and FortiAnalyzer (8.0.2, 7.6.8, 7.4.12, 7.2.13) fixing Critical/High flaws found through AI-assisted security testing. CVE identifiers, CVSS and technical details are embargoed until 2026-11-10; none are stated and none are invented here. Defenders should patch now.

Other bulletin items: CVE-2025-70795 (Safetica ProcessMonitorDriver 11.26.18, abused with Lenovo BootRepair.sys 2.5.30.11281) is used by The Gentlemen ransomware EDR killer to terminate security processes (BYOVD), per Acronis. CVE-2026-80097 ('AuthMask') is an Android Microsoft Authenticator token-theft flaw (Enclave.ai). CVE-2026-93348 (CVSS 8.6) is code execution in the Unsloth model loader, fixed in unsloth_zoo 2026.8.14 (Pillar Security). The bulletin also notes an open directory at 185.157.161.148 tied to n0n ransomware tooling (23+ victims across 14 countries). The CVSS score is left null because the bulletin covers multiple issues with differing scores.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1608.001 Upload Malware
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1569.002 Service Execution
- T1505.003 Web Shell
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1484.001 Group Policy Modification
- T1033 System Owner/User Discovery
- T1071.001 Web Protocols
- T1496.001 Compute Hijacking

## Sources

- [ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories](https://thehackernews.com/2026/10/threatsday-critical-firewall-flaws.html)
- [VulnCheck: Cache Me If You Can (Gotenberg CVE-2026-42589 exploitation, cache_base)](https://www.vulncheck.com/blog/cache-me-if-you-can)
- [Averlon: CVE-2026-42589 Gotenberg Unauthenticated RCE via ExifTool Metadata Key Injection](https://research.averlon.ai/vulnerability-intelligence/cve/CVE-2026-42589)
- [Vulert: CVE-2026-42589 Gotenberg Unauthenticated RCE](https://vulert.com/vuln-db/gotenberg-has-unauthenticated-rce-via-exiftool-metadata-key-injection-in-github-com-gotenberg-gotenberg)
- [Picus: PHP2Shell - Two Critical PHP RCE Flaws Explained](https://www.picussecurity.com/resource/php2shell-the-two-critical-php-rce-flaws-cve-2026-109618-cve-2026-109619-explained)
- [BleepingComputer: Amazon says PHP2Shell exploitation began 4 days before patches](https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/)
- [BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws](https://bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws)
- [Tanium: PHP2Shell - Responding to CVE-2026-109618 and CVE-2026-109619](https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619)
- [Fortinet CISO Collective: Security Hardening Release for Multiple Products](https://www.fortinet.com/cn/blog/ciso-collective)
- [Help Net Security: Fortinet patches critical FortiOS flaws found with AI help](https://www.helpnetsecurity.com/?p=389080)
- [Acronis TRU: The Gentlemen - a closer look at a not-so-gentle RaaS operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4771