Attackers are actively targeting critical network infrastructure, including firewalls, VPN gateways, application delivery controllers and other appliances. Eclypsium’s October InfraTrust Pulse report highlights the PHP2Shell vulnerabilities as a particular concern because many network appliances embed PHP in their web-based management interfaces.
InfraTrust tracks security advisories affecting network devices, servers, firmware, chips and other infrastructure. Between September 18 and October 14, the report recorded 133 new advisories from 18 vendors covering 2,813 vulnerabilities.
Among those advisories, 37 were rated critical, five had a maximum CVSS score of 10.0, and 58 could be exploited remotely without authentication.
Sixteen newly published advisories involved vulnerabilities listed in the CISA Known Exploited Vulnerabilities Catalog (KEV) because they were being actively exploited.
InfraTrust also warns that many firewalls, VPN gateways, application delivery controllers and network-attached storage devices use PHP in their management interfaces. Because vendors compile PHP into appliance firmware, customers generally cannot install PHP security updates themselves. They must wait for the vendor to release updated firmware.
Until patches are available for PHP2Shell, InfraTrust recommends preventing PHP-based management interfaces from being exposed directly to the internet.
Attackers target infrastructure at the network edge
Several of the most serious vulnerabilities affect systems positioned at the edge of corporate networks or used to manage other infrastructure. Attackers target these devices because they can provide an initial foothold in an organization or act as a launch point for further attacks.
InfraTrust identified active exploitation of the following vulnerabilities:
- Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 were disclosed on September 27 while attacks against unpatched appliances were already being observed. Another NetScaler vulnerability, CVE-2026-88779, affects appliances configured for SAML and was added to CISA’s KEV catalog after exploitation was detected.
- Ivanti Connect Secure: CVE-2026-104935 allows an unauthenticated remote attacker to execute arbitrary commands on a vulnerable VPN gateway. Ivanti said a limited number of customers were being exploited when it issued its advisory. CISA later added the vulnerability to the KEV catalog.
- Check Point Security Management Server: CVE-2026-93616 allows an unauthenticated attacker to upload and execute scripts on the management and logging system. Check Point Research observed a targeted attack against Spark customers exploiting the flaw on September 12.
- Cisco Catalyst SD-WAN Manager: CVE-2026-76504 allows unauthenticated attackers to bypass authentication and obtain administrator access to the management API. Cisco became aware of active exploitation in September.
- Arista VeloCloud Orchestrator: CVE-2026-93952 is a maximum-severity vulnerability affecting systems used to configure SD-WAN edge devices. Arista said the flaw was being actively exploited and later announced a second, separate exploited vulnerability, CVE-2026-114625, in the same product on October 22.
- FortiMail: CVE-2026-104286 is a critical path-traversal vulnerability that allows unauthenticated attackers to write arbitrary files through the web interface. Fortinet confirmed that the flaw was used in an attack.
- Cisco Secure Email Gateway: CVE-2026-76519 allows a malicious email attachment to write arbitrary files or execute commands as root on a vulnerable system. Cisco learned of exploitation in October.
- F5 BIG-IP APM: CVE-2026-94127 is a critical heap-overflow vulnerability that enables unauthenticated remote code execution on systems configured as OAuth authentication servers. F5 said the vulnerability has been exploited.
- PAN-OS management interface: Palo Alto Networks reported that CVE-2026-0322 can be exploited in an attack against a firewall. The flaw allows an authenticated administrator with network access to execute code as root.
PHP2Shell exposes firmware update challenges
InfraTrust says the recently disclosed PHP2Shell vulnerabilities reveal another weakness in network infrastructure: many appliances embed PHP directly into their management interfaces.
The two flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. The PHP Project fixed them on October 21.
Although many PHP vulnerabilities affect websites and web applications, PHP is also used in the management interfaces of firewalls, application delivery controllers, VPN appliances and network-attached storage devices.
Administrators typically cannot update the PHP component independently because appliance vendors compile it into the firmware. Customers must instead wait for each vendor to rebuild and release firmware or software containing patched PHP versions.
Shortly after the vulnerabilities were disclosed, Palo Alto Networks, F5, NetScaler, Check Point and QNAP confirmed that some of their products were affected and said they were developing fixes.
The report highlights similar risks involving other software components bundled by infrastructure vendors. CVE-2026-31431, a Linux kernel privilege-escalation vulnerability known as Copy Failure, now appears in 29 advisories from eight vendors, up from 19 advisories from six vendors the previous month.
InfraTrust also found older vulnerabilities being exploited in bundled components, including an Android kernel flaw affecting HP LaserJet Enterprise printers and a 2020 jQuery vulnerability in Dell Data Lakehouse software.
Prioritized patching recommended
Because remote-access gateways can provide a route into corporate networks, InfraTrust recommends prioritizing patches for NetScaler and Ivanti Connect Secure. It also recommends applying Fortinet’s October 22 security updates for FortiOS, FortiManager and FortiAnalyzer on internet-connected devices.
Administrators should also focus on Check Point Security Management Server, Cisco Catalyst SD-WAN Manager, VeloCloud Orchestrator, FortiMail, Cisco Secure Email Gateway, affected BIG-IP APM systems and PAN-OS management interfaces.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com