Threat Intelligence Bulletin — Weekly Roundup of Critical Vulnerabilities, Rented RATs, and Active Exploitation (CVE-2026-109618, CVE-2026-109619, CVE-2026-41940, CVE-2026-42589)

Publication date: October 29, 2026
Category: Threat Intelligence and Security Alerts

Introduction

The weekly threat landscape curated by Ravie Lakshmanan reveals a troubling convergence of unpatched legacy software vulnerabilities, abuse of trusted administrative tools (Living-off-the-Land), remote access trojans (RATs) evolved from information stealers, and the active adoption of artificial intelligence models by threat actors. Notable incidents include ongoing mass scanning against critical core PHP flaws (PHP2Shell), active exploitation of vulnerabilities in Gotenberg and cPanel, and the commercialization of malware infrastructure through Malware-as-a-Service (MaaS) schemes. This analysis outlines the critical attack vectors and necessary defensive countermeasures.

What is the Threat Scope and Exploit Ecosystem? (General Analysis)

The weekly threat cycle highlights multiple vectors where implicit trust in services, enterprise applications, and development frameworks is subverted.

Key technical components analyzed include:

• Core PHP Vulnerabilities (PHP2Shell): Tracked as CVE-2026-109618 and CVE-2026-109619, both carrying an official CVSS v4.0 score of 9.2 (CRITICAL). These involve memory management flaws (use-after-free and corruption via OOM handling errors with longjmp) enabling unauthenticated Remote Code Execution (RCE). Both are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
• cPanel/WHM Authentication Bypass (CVE-2026-41940): CVSS v4.0 score of 9.3 (CRITICAL) under CWE-306, allowing unauthenticated remote access to control panels and widespread exploitation in ransomware attacks.
• Gotenberg RCE (CVE-2026-42589): CVSS v3.1 score of 9.8 (CRITICAL) under CWE-78, where newline injection in JSON metadata objects allows arbitrary OS command execution via ExifTool.
• AI Model Loader Code Injection (CVE-2026-93348): CVSS v4.0 score of 8.6 (HIGH) under CWE-94 in Unsloth Zoo, leading to RCE upon processing malicious model configurations.

How Does It Work? (Technical Analysis)

Behavioral analysis of these threats highlights sophisticated and repetitive attack mechanics:

• Initial infection flow and exploit entry:

• In PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619), out-of-memory handling routines manipulate execution contexts via longjmp() or unreset global states, leaving freed memory structures in a stale state accessible for reading or branching in subsequent requests, resulting in unauthenticated RCE.

• For Gotenberg (CVE-2026-42589), the /forms/pdfengines/metadata/write HTTP endpoint accepts JSON metadata keys passed directly to ExifTool without character validation. An embedded newline (\n) splits the standard input stream into a new argument line, enabling attackers to inject flags like -if to evaluate Perl expressions.

• In Unsloth Zoo (CVE-2026-93348), the get_transformers_model_type() function collects nested model_type values in config.json without an allowlist. Attackers embed newlines to terminate generated import statements and execute arbitrary Python code via exec().

• Persistence and privilege escalation mechanisms:

  • Documented use of vulnerable drivers such as Safetica ProcessMonitorDriver (CVE-2025-70795, CVSS v3.1: 5.5, CWE-269) to send crafted IOCTL requests terminating critical security processes, facilitating deployment by ransomware operations like The Gentlemen.
  • Abuse of legitimate Mobile Device Management (MDM) platforms such as Hexnode and Rippling via social engineering to deploy Remote Monitoring and Management (RMM) tools and establish persistent access.

• Exfiltration and C2 communication:

  • Deployment of advanced backdoors like Sirius through weaponized PDF documents abusing /OpenAction and /Launch objects to trigger Base64-encoded PowerShell commands, performing process hollowing into trusted Windows binaries (msbuild.exe, svchost.exe).
  • Evolution of infostealers into fully-fledged RATs (e.g., Stadia / StealC, ICMacOS) incorporating hidden desktop control, live shells, and session hijacking modules.

Affected Systems / Environments

The impact spans a diverse range of enterprise infrastructures and developer platforms:

• Web server environments running vulnerable core PHP versions.
• Servers operating cPanel and WHM versions post-11.40.
• Gotenberg containers and instances prior to version 8.31.0.
• AI development environments integrating vulnerable libraries like Unsloth Zoo (versions 2025.9.9 through 2026.8.19).
• Fortinet security appliances, MDM platforms (Hexnode, Rippling), and enterprise Android environments.

Mitigation and Detection

Remediation

• Priority Patching: Immediately apply official security patches and hardening updates provided by core PHP maintainers, Gotenberg (v8.31.0 or later), cPanel, and Fortinet.
• Input Validation and Sanitization: Ensure any metadata processing engine or AI model loading framework implements strict character validation and allowlists (stripping out newlines and control characters).
• MDM and Access Audit: Review mobile device management consoles for unauthorized enrollments and revoke any credentials or tokens exposed in public code repositories.

Detection

• Monitor HTTP requests directed at Gotenberg metadata endpoints containing newline characters (\n) or ExifTool invocations featuring suspicious flags like -if.
• Inspect logs for legitimate Windows binaries (msbuild.exe, svchost.exe) displaying anomalous memory injection (process hollowing) behaviors originating from suspicious PDF document handling.

“The persistence of critical vulnerabilities in core foundational components like PHP and Gotenberg demonstrates that attackers continue to capitalize on poor patch hygiene and lax input validation in modern architectures.”

Wrapping Up

The activity reported this week highlights that organizations must contend not only with emerging AI-driven threats and advanced remote access trojans, but also with the relentless exploitation of known flaws and operational oversights. Automated credential harvesting and unmonitored code exploitation demand a proactive defensive posture rooted in rigorous vulnerability management and continuous attack surface monitoring.

References

• CISA. (2026). Known Exploited Vulnerabilities Catalog (CVE-2026-109618, CVE-2026-109619, CVE-2026-41940). U.S. Government. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Fortinet. (2026). Fortinet Releases Security Updates and Hardening Guidelines for Multiple Products. https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-hardening-release-for-multiple-products
• Gotenberg. (2026). Security Advisory: ExifTool Command Injection in Gotenberg (GHSA-rqgh-gxv4-6657). GitHub Advisory Database. https://github.com/gotenberg/gotenberg/security/advisories/GHSA-rqgh-gxv4-6657
• Microsoft. (2026). Microsoft Security Update Guide: CVE-2026-80097 (Microsoft Authenticator Elevation of Privilege Vulnerability). https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097
• Sysdig. (2026). PHP2Shell: Detecting Unauthenticated Remote Code Execution in PHP Core (CVE-2026-109618 and CVE-2026-109619). https://www.sysdig.com/blog/php2shell-cve-2026-109618-and-cve-2026-109619-detecting-unauthenticated-remote-code-execution-in-php-core
• Wordfence. (2026). PHP2Shell Update: Still No Confirmed WordPress Compromises and Answers to the Questions We’re Hearing Most. https://www.wordfence.com/blog/2026/10/php2shell-update-still-no-confirmed-wordpress-compromises-and-answers-to-the-questions-were-hearing-most/