ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories

This week's roundup covers over 30 security stories spanning exploited bugs, careless exposures, and AI-assisted attacks. Fortinet shipped a coordinated patch bundle for FortiOS, FortiManager, and FortiAnalyzer fixing critical and high-severity issues found via AI-assisted research, with disclosure held back until November 10, 2026. Attackers continue hammering CVE-2026-109618/CVE-2026-109619 (PHP2Shell) against WordPress despite no confirmed compromises so far, while VulnCheck tracked active exploitation of the critical Gotenberg RCE flaw CVE-2026-42589 (CVSS 9.8) to deploy a Go-based reverse shell. Microsoft Authenticator's now-patched CVE-2026-80097 (AuthMask) could let a zero-permission Android app impersonate trusted apps and steal work-account tokens, and a new AI-powered C2 framework called NIK C2 combines credential theft, RDP hijacking, and screen-lock ransomware.

Other notable items include CloudSEK's discovery of MR ROBOT, a rented Android banking-trojan platform targeting Indian bank customers via Telegram-based kits; Hudson Rock's FortiBleed 2.0 findings exposing 40,573 secrets from leaked FortiGate configs; a 68 GB data breach at a Philippine government agency left openly accessible alongside the attacker's own toolkit; and a new session-hijacking RAT called DarkCore that abuses stolen browser sessions for Gmail, WhatsApp, and MediaFire access. The bulletin also flags an npm supply-chain worm compromising 42 GitHub repositories, Unsloth's CVE-2026-93348 model-loading RCE, and the Gentlemen ransomware group's claim of over 800 victims using EDR-killing drivers.