FortiBleed 2.0 Uncovers 40,573 Credentials
FortiBleed 2.0, a credential-harvesting campaign targeting FortiGate firewalls, has been expanded by Hudson Rock. The latest probe identified 975 new domains and 40,573 exposed secrets, including 37,076 local-user records and 1,576 Active Directory LDAP bind records. The data derives from 1,703 FortiGate source files linked to 1,689 host identifiers, with configuration material dating to February 2026. The campaign’s name, FortiBleed, reflects the data exfiltration method that leverages misconfigured firewall logs.
Exposure Scope
The exposed secrets span local accounts, domain users, and LDAP bind credentials. The breadth of the leak indicates that attackers have accessed a wide range of FortiGate installations, potentially including both on-premises and cloud-hosted appliances. No specific firmware versions were named, but the source files suggest that the attack vector remains viable across multiple FortiGate releases.
Mitigation Guidance
Fortinet has not issued a public patch for FortiBleed 2.0. Operators should:
- Verify that firewall logs are not exposed to the internet.
- Apply the latest FortiGate firmware updates.
- Disable unused management interfaces.
- Conduct a credential audit to detect compromised accounts.
PHP2Shell Scanning Persists Across 5 Million WordPress Sites
WordPress security firm Wordfence reported that, as of October 28 2026, it had not confirmed any site compromise via the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). However, the company continues to observe PHP2Shell-related requests on more than 5 million protected sites. These requests represent scanning and exploitation attempts but do not confirm successful exploitation.
Attack Path
PHP2Shell exploits unauthenticated remote code execution in PHP core by injecting malicious payloads through the PHP interpreter. The vulnerability is triggered by malformed PHP code that bypasses authentication checks. Attackers typically deliver the payload via HTTP requests that include a specially crafted PHP snippet.
Mitigation Steps
- Update WordPress core to the latest stable release.
- Disable the PHP interpreter on non-WordPress directories.
- Enable web application firewalls that block malformed PHP requests.
- Monitor access logs for repeated PHP2Shell-style requests.
Other Threats Highlighted This Week
The ThreatsDay bulletin also listed 26 additional stories, including:
- Banking trojans available for rent.
- Weaponized PDF files used in spear-phishing campaigns.
- Token theft incidents involving compromised authentication tokens.
- Institutional DNS hijacking via domain shadowing.
- A new ransomware strain targeting industrial control systems.
Common Themes
Several of the reports share a pattern of attackers exploiting well-known software weaknesses or misconfigurations. The FortiBleed and PHP2Shell cases illustrate that legacy vulnerabilities can remain exploitable long after public disclosure, especially when patching is delayed or misconfigured.
Immediate Actions for Security Teams
- FortiGate: Run a credential audit, update firmware, and restrict log exposure.
- WordPress: Apply core updates, disable PHP where unnecessary, and monitor for PHP2Shell traffic.
- General: Review all exposed credentials, enforce least-privilege access, and implement multi-factor authentication.
Open Questions
- Which specific FortiGate firmware versions are most at risk?
- Will Fortinet release a dedicated patch for FortiBleed 2.0?
- How many WordPress sites have successfully mitigated PHP2Shell after the latest core update?
The evidence suggests that attackers continue to target both legacy and actively maintained platforms. Prompt patching, configuration hardening, and continuous monitoring remain the most effective defenses against these evolving threats.
Related coverage
- PHP2Shell RCE Exploits Force Immediate Patch for Millions of Sites
- Volt Typhoon Silent Train Deploys Four Zero-Day Exploits