ThreatsDay: Fortinet fixes, PHP2Shell scans, Authenticator token flaw
Original title: ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
Fortinet is withholding flaw details until November 10 while Hudson Rock reports 40,573 exposed FortiGate secrets.
The Hacker News weekly bulletin collects several unrelated threat reports. Wordefence still sees PHP2Shell scanning against WordPress sites but knows of no successful compromise as of October 28. Hudson Rock’s FortiBleed 2.0 review cites 40,573 exposed secrets from FortiGate files, and Infoblox describes DNS shadowing of school and government domains for gambling pages. Fortinet shipped critical and high-severity fixes for FortiOS, FortiManager and FortiAnalyzer with details held until November 10, and a patched Microsoft Authenticator Android flaw, CVE-2026-80097, could yield tokens to a zero-permission app.
Unconfirmed: PHP2Shell requests show scanning and exploitation attempts, not confirmed successful WordPress compromises.
- PHP2Shell covers CVE-2026-109618 and CVE-2026-109619; success on WordPress is unconfirmed.
- FortiBleed 2.0: 975 domains, 1,703 FortiGate files, configs dated around February 2026.
- Hidden Hawk mapped school and government hostnames to gambling pages via DNS.
- A Gitee scan found 26,400 unique verified-live credentials in public repositories.
- AuthMask let an unprivileged Android app request tokens for Microsoft first-party apps.
Impact: Token theft, exposed secrets, and unauthenticated scanning attempts
| Product | Affected | Fixed in |
|---|---|---|
| Fortinet FortiOS | — | coordinated security updates; details withheld until November 10, 2026 |
| Fortinet FortiManager | — | coordinated security updates; details withheld until November 10, 2026 |
| Fortinet FortiAnalyzer | — | coordinated security updates; details withheld until November 10, 2026 |
| Microsoft Authenticator | Android devices with Authenticator and a work account | now-patched |
- 1.Apply Fortinet’s FortiOS, FortiManager and FortiAnalyzer updates before details are published November 10.
- 2.Do not share bank usernames or passwords with AI tools or agents.
- 3.Update Microsoft Authenticator; the Android token flaw is described as now patched.
- Threat actors
- Hidden Hawk
- Organizations
- WordefenceHudson RockInfobloxBank of AmericaCequence
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-80097 | Improper Authentication in Microsoft Authenticator Enables Local Privilege Escalation | 8.6 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 13.163.205.35 | of the transfer, then left that log open on the internet at 13.163.205[.]35:80. "The copy finished in under 24 minutes on September 6 |
| ipv4 | 185.157.161.148 | tion's full workflow as of September 2026. The directory at 185.157.161[.]148 includes an AI coding agent configured with about 150 mod |
From the original article
13 min read at thehackernews.com
Some attacks take real skill. Others just need someone to leave a door open. This week has both.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.