Search — “CVE-2026-42589”

A ThreatsDay roundup reports that threat actors are exploiting CVE-2026-42589, a critical RCE in Gotenberg, to deliver a Go reverse shell called cache_base, citing VulnCheck. The roundup itself is unverified and the brief marks the item as unconfirmed, so treat the claim as reported rather than confirmed. Hunters could look for Gotenberg processes spawning shells and outbound connections to unfamiliar C2 hosts.

VulnCheck reports that threat actors are exploiting CVE-2026-42589, a critical RCE in Gotenberg patched in May 2026, to deliver a Go-based reverse shell called cache_base. The activity reportedly originated from a residential Japanese IP in early October 2026, with 1,358 exploitation events from 128 unique source IPs over the past 30 days. Hunters should look for Gotenberg service processes spawning unexpected children and the cache_base reverse shell's C2 registration and shell activity.