Weekly Threat Roundup: Exposed Firewall Secrets and a WordPress Flaw Under Active Scanning

The Hacker News ThreatsDay bulletin describes a week of both clever tricks and careless mistakes. It says attackers are borrowing trust from familiar apps, websites and AI tools, and that old bugs and exposed passwords are still being exploited. This summary covers only the opening of that bulletin, which promises 26 more stories.

WordPress security company Wordfence said it is not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618 and CVE-2026-109619) as of 28 October 2026. It still sees PHP2Shell-related requests across the more than 5 million sites it protects. Wordfence stressed that these requests show scanning and exploitation attempts, but not whether any attempt succeeded. Its cleaning and incident response teams have not handled a compromise attributed to these flaws.

Separately, Hudson Rock's investigation into the FortiBleed credential harvesting campaign found 975 newly identified domains and 40,573 exposed secrets. These include 37,076 local-user records and 1,576 Active Directory LDAP bind records. The data comes from 1,703 newly obtained FortiGate source files linked to 1,689 host identifiers. Hudson Rock said the configuration material dates to around February 2026, earlier than the material in its first investigation. The new findings are codenamed FortiBleed 2.0.