EN PT-BR
← Voltar ao feed
high exploit público government education financial services retail telecommunications energy software

ThreatsDay roundup: FortiBleed 2.0 exposes 40,573 secrets, Microsoft Authenticator token theft flaw, AI-assisted n0n ransomware

1 fonte(s) · 1 atualização(ões) · publicado 29/10/2026 16:11 · coletado há 3 dias

The Hacker News ThreatsDay bulletin aggregates roughly 30 security stories from the week of October 28, 2026. Highlights include Hudson Rock's FortiBleed 2.0 follow-up, which uncovered 975 new domains and 40,573 exposed secrets from 1,703 FortiGate configuration files dating to February 2026, and a patched Microsoft Authenticator flaw (CVE-2026-80097, "AuthMask") that let a zero-permission Android app impersonate Microsoft first-party apps and receive their work-account tokens. Fortinet shipped a coordinated set of critical and high-severity updates for FortiOS, FortiManager and FortiAnalyzer, with details embargoed until November 10, 2026. Wordfence reported ongoing PHP2Shell (CVE-2026-109618, CVE-2026-109619) scanning and exploitation attempts across 5 million sites but no confirmed WordPress compromise as of October 28. Other items cover an AI-assisted n0n ransomware workspace, a 68 GB theft from a Philippine government agency, domain shadowing against school and government DNS, and a 42-repository GitHub/npm supply-chain campaign.

Entenda a falha

A vulnerabilidade

CVE-2026-80097 ("AuthMask") is a flaw in Microsoft Authenticator for Android. A malicious app with zero permissions can impersonate Microsoft first-party apps and receive their work-account tokens from the Authenticator broker. It has been patched, but the articles give no fixed version number. CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell") are linked to WordPress. The articles give no product component, requirements or impact, only that Wordfence sees scanning and exploitation attempts. Fortinet also shipped critical and high-severity updates for FortiOS, FortiManager and FortiAnalyzer, with details embargoed until November 10, 2026.

Como funciona

For AuthMask, a malicious app installed on the device interacts with the Authenticator broker, which brokers sign-in tokens for Microsoft apps. The app tricks the broker into treating it as a Microsoft first-party app, and the broker then hands over the work-account tokens. The articles do not describe the exact calls or checks involved. For PHP2Shell, Wordfence only reports requests hitting the sites it protects, and the articles do not describe how the vulnerable process works.

Por que é vulnerável

For AuthMask, the story implies the broker could be fooled about the identity of the calling app, so it released tokens meant only for Microsoft apps, with no permission needed. The articles do not name the exact missing check or explain what the fix changes. They give no root cause for the PHP2Shell CVEs or the embargoed Fortinet bugs.

Como foi descoberta

AuthMask was attributed to Enclave and has since been patched by Microsoft; the articles do not say how or when it was reported. The PHP2Shell activity comes from Wordfence telemetry: ongoing scanning and exploitation attempts across more than 5 million protected sites. Wordfence says it has not handled any WordPress compromise attributed to these CVEs as of October 28, and that the requests do not show whether an attempt succeeded. Fortinet's coordinated updates have details embargoed until November 10, 2026. Separately, Hudson Rock's FortiBleed 2.0 follow-up analyzed FortiGate configuration files from about February 2026; this is a credential exposure, not a described flaw.

Explicação gerada por IA a partir da matéria e dos artigos, em 29/10/2026 17:16.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52704 ↗ · remoto · php · pub. 22/10/2026 verificado

    PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

    This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.

    CVE-2026-109618 · autor: OffSec · explicação gerada por IA

Detalhes técnicos

  • FortiBleed 2.0 (Hudson Rock): 37,076 local-user records and 1,576 Active Directory LDAP bind records across 1,689 host identifiers.
  • AuthMask / CVE-2026-80097 (Enclave): malicious Android app tricks the Authenticator broker into handing over tokens, no permissions required.
  • n0n ransomware (SOCRadar): open directory at 185.157.161[.]148 with an AI coding agent using ~150 models and $7,216 in usage; entry via credential stuffing on 305 FortiGate SSL-VPN devices, exposed AWS keys, weak RDP/WinRM; 23 victims in 14 countries.
  • Philippine agency breach (Hunt.io): 68 GB and 27 SQL Server backups copied in under 24 minutes on September 6, 2026; transfer log left open at 13.163.205[.]35:80 alongside a rebranded GodPotato build, a PowerShell stager and an Impacket environment.
  • Camera management software (Huntress): compromised app from a Korean camera/NVR vendor sideloads DLLs via the legitimate WpcMon.exe.
  • AI agent impersonation (Cequence): one actor rotates ~32 AI bot identities (ChatGPT, Claude, Perplexity) hitting ~90 file paths for .env files, cloud credential files and SSH keys, 50–190 requests per burst.
  • Domain shadowing (Infoblox): Hidden Hawk CNAMEs institutional hostnames to Cloudflare Pages gambling doorways; an Indian government domain had entire subzones delegated with a wildcard.
  • Supply chain (JFrog/SafeDep): 42 hijacked GitHub repositories across 11 owners with 12.9–13.7 MB polymorphic wrappers decoding to a CI-publisher payload tied to a Miasma-family npm worm.
  • Gitee scan (Ben Zimmermann): 26,400 verified-live credentials across 7.25 million public repositories.

Remediação

  • Apply Fortinet's FortiOS/FortiManager/FortiAnalyzer updates ahead of the November 10 disclosure.
  • Update Microsoft Authenticator on Android and audit work-account token activity.
  • Rotate FortiGate local-user and LDAP bind credentials implicated in FortiBleed; rotate any secrets committed to public Gitee or GitHub repositories.
  • Review DNS administration access and audit for unexpected CNAME records or subzone delegations.

Linha do tempo

  1. thehackernews.com ↗ · pub. 29/10/2026 16:11 · coletado 29/10 17:00 primeiro registro

    ThreatsDay roundup: FortiBleed 2.0 exposes 40,573 secrets, Microsoft Authenticator token theft flaw, AI-assisted n0n ransomware

    ler a análise desta fonte

    The Hacker News ThreatsDay bulletin aggregates roughly 30 security stories from the week of October 28, 2026. Highlights include Hudson Rock's FortiBleed 2.0 follow-up, which uncovered 975 new domains and 40,573 exposed secrets from 1,703 FortiGate configuration files dating to February 2026, and a patched Microsoft Authenticator flaw (CVE-2026-80097, "AuthMask") that let a zero-permission Android app impersonate Microsoft first-party apps and receive their work-account tokens. Fortinet shipped a coordinated set of critical and high-severity updates for FortiOS, FortiManager and FortiAnalyzer, with details embargoed until November 10, 2026. Wordfence reported ongoing PHP2Shell (CVE-2026-109618, CVE-2026-109619) scanning and exploitation attempts across 5 million sites but no confirmed WordPress compromise as of October 28. Other items cover an AI-assisted n0n ransomware workspace, a 68 GB theft from a Philippine government agency, domain shadowing against school and government DNS, and a 42-repository GitHub/npm supply-chain campaign.

    Technical Details

    • FortiBleed 2.0 (Hudson Rock): 37,076 local-user records and 1,576 Active Directory LDAP bind records across 1,689 host identifiers.
    • AuthMask / CVE-2026-80097 (Enclave): malicious Android app tricks the Authenticator broker into handing over tokens, no permissions required.
    • n0n ransomware (SOCRadar): open directory at 185.157.161[.]148 with an AI coding agent using ~150 models and $7,216 in usage; entry via credential stuffing on 305 FortiGate SSL-VPN devices, exposed AWS keys, weak RDP/WinRM; 23 victims in 14 countries.
    • Philippine agency breach (Hunt.io): 68 GB and 27 SQL Server backups copied in under 24 minutes on September 6, 2026; transfer log left open at 13.163.205[.]35:80 alongside a rebranded GodPotato build, a PowerShell stager and an Impacket environment.
    • Camera management software (Huntress): compromised app from a Korean camera/NVR vendor sideloads DLLs via the legitimate WpcMon.exe.
    • AI agent impersonation (Cequence): one actor rotates ~32 AI bot identities (ChatGPT, Claude, Perplexity) hitting ~90 file paths for .env files, cloud credential files and SSH keys, 50–190 requests per burst.
    • Domain shadowing (Infoblox): Hidden Hawk CNAMEs institutional hostnames to Cloudflare Pages gambling doorways; an Indian government domain had entire subzones delegated with a wildcard.
    • Supply chain (JFrog/SafeDep): 42 hijacked GitHub repositories across 11 owners with 12.9–13.7 MB polymorphic wrappers decoding to a CI-publisher payload tied to a Miasma-family npm worm.
    • Gitee scan (Ben Zimmermann): 26,400 verified-live credentials across 7.25 million public repositories.

    Remediation

    • Apply Fortinet's FortiOS/FortiManager/FortiAnalyzer updates ahead of the November 10 disclosure.
    • Update Microsoft Authenticator on Android and audit work-account token activity.
    • Rotate FortiGate local-user and LDAP bind credentials implicated in FortiBleed; rotate any secrets committed to public Gitee or GitHub repositories.
    • Review DNS administration access and audit for unexpected CNAME records or subzone delegations.