Eclypsium's October InfraTrust Pulse report warns that attackers are actively exploiting vulnerabilities in critical network infrastructure, with newly disclosed PHP flaws putting the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. The monthly report tracks security advisories affecting network devices, servers, firmware, chips, and other infrastructure. Between September 18 and October 14, InfraTrust tracked 133 new advisories across 18 vendors, covering 2,813 vulnerabilities. Of those advisories, 37 were rated critical, five carried a maximum CVSS score of 10.0, and 58 could be exploited remotely without authentication.
Sixteen of the newly published advisories included vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog at the time they were published, meaning they were already being exploited in the wild. The report singles out two PHP flaws, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution and were fixed by the PHP project on October 21. While attention on these flaws, known as PHP2Shell, has focused on PHP-based websites and web applications, PHP is also embedded in the management interfaces of firewalls, application delivery controllers, VPN appliances, and network-attached storage devices.
Because vendors compile PHP directly into appliance firmware, customers typically cannot install the PHP security updates themselves and must wait for each vendor to rebuild and release updated firmware or software containing the patched version. InfraTrust recommends that administrators keep PHP-backed management interfaces off the Internet until PHP2Shell patches arrive. Soon after disclosure, Palo Alto Networks, F5, NetScaler, Check Point, and QNAP confirmed that some of their products were affected while fixes were still in development.
The report notes that the most serious vulnerabilities affect systems at the edge of enterprise networks or those used to manage other infrastructure, since threat actors target such devices for initial access to corporate environments or as a springboard for further attacks. It also highlights a similar bundling problem with other components. CVE-2026-31431, a Linux kernel privilege escalation flaw known as Copy Fail, has now appeared in 29 advisories across eight vendors, up from 19 advisories from six vendors the previous month. InfraTrust also found older, exploited vulnerabilities in bundled components, including an Android kernel flaw affecting HP LaserJet Enterprise printers and a 2020 jQuery vulnerability in Dell Data Lakehouse software.
For patching priorities, InfraTrust recommends administrators address NetScaler and Ivanti Connect Secure first because these remote-access gateways can serve as a doorway into corporate networks. It next points to Fortinet's October 22 FortiOS, FortiManager, and FortiAnalyzer security updates for internet-facing devices. The report then recommends focusing on Check Point Security Management Server, Cisco Catalyst SD-WAN Manager, VeloCloud Orchestrator, FortiMail, Cisco Secure Email Gateway, affected BIG-IP APM systems, and PAN-OS management interfaces.
More cybersecurity news from TechManNews.
