A report from Eclypsium's InfraTrust Pulse highlights 133 new security advisories across 18 vendors, with many vulnerabilities already under active exploitation. Among the most concerning are PHP2Shell flaws that allow unauthenticated remote code execution on network appliances such as firewalls, VPNs, and storage devices, whose embedded PHP cannot be patched by customers independently.
The InfraTrust Pulse report, published October 28, examined security advisories affecting network devices, servers, firmware, chips, and other infrastructure between September 18 and October 14. Of the 2,813 vulnerabilities covered across 133 advisories, 37 were rated critical, five had a maximum CVSS score of 10.0, and 58 could be exploited remotely without authentication. Sixteen advisories included vulnerabilities listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as actively exploited.
Among the most serious flaws highlighted are those impacting systems at the edge of enterprise networks. Threat actors exploit these devices to gain initial access to corporate environments or as a springboard for further attacks. The report details active exploitation of vulnerabilities in Citrix NetScaler ADC and Gateway, Ivanti Connect Secure, Check Point Security Management Server, Cisco Catalyst SD-WAN Manager, Arista VeloCloud Orchestrator, FortiMail, Cisco Secure Email Gateway, F5 BIG-IP APM, and PAN-OS management interfaces.
The report also warns about PHP2Shell, two recently disclosed PHP flaws (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. While attention has focused on websites and web applications, PHP is similarly embedded into the management interfaces of firewalls, VPN appliances, application delivery controllers, and network-attached storage devices. Because vendors compile PHP into appliance firmware, customers cannot apply the recent PHP security updates themselves and must wait for each vendor to release updated firmware. Soon after disclosure, Palo Alto Networks, F5, NetScaler, Check Point, and QNAP confirmed that some products were affected and said they were developing fixes.
The report also notes a similar issue with other bundled components, including the Linux kernel privilege escalation flaw Copy Fail (CVE-2026-31431), which now appears in 29 advisories across eight vendors, up from 19 advisories from six vendors the previous month. InfraTrust recommends administrators prioritize patching NetScaler and Ivanti Connect Secure, as these remote-access gateways serve as doorways into corporate networks, followed by Fortinet updates and the other listed devices. It also recommends ensuring PHP-backed management interfaces are not exposed to the Internet while waiting for vendor patches.
Analysis
Why This Matters
- Network infrastructure devices such as firewalls, VPNs, and gateways are perimeter systems; exploitation can directly lead to corporate network compromise.
- The embedded PHP issue means many appliances may remain vulnerable for an extended period while customers wait for vendor firmware updates, creating a window of exposure.
- Multiple vulnerabilities are already under active exploitation, indicating threat actors are moving quickly to target unpatched systems.
Background
Network infrastructure appliances have increasingly become targets for threat actors seeking initial access to corporate environments. The InfraTrust Pulse report is a monthly publication from Eclypsium that tracks security advisories for network devices, firmware, and chips, aimed at raising awareness of vulnerabilities in these critical systems.
What to Watch
- Whether vendors release patches for the PHP2Shell flaws quickly; any significant delay will extend the exposure window for many appliances.
- Updates to CISA's KEV catalog, which may add further actively exploited CVEs from the report.
- Adoption of InfraTrust's recommendation to restrict management interfaces from internet exposure as a temporary mitigation measure.
Checked
12 claims in this story checked against 1 source: 9 supported.
Show each claim
- SupportedThe report warns of actively exploited vulnerabilities in critical network infrastructure.BleepingComputer: “Attackers are actively exploiting vulnerabilities across critical network infrastructure”
- SupportedPHP2Shell flaws pose a risk to embedded management interfaces, according to researchers.BleepingComputer: “InfraTrust also warns that the recently disclosed PHP2Shell vulnerabilities expose another weakness in network infrastructure, as many appliances embed PHP directly into their management interfaces.”
- SupportedThe report tracked 133 new advisories across 18 vendors, with many vulnerabilities already being actively exploited.BleepingComputer: “Between September 18 and October 14, InfraTrust tracked 133 new security advisories across 18 vendors, covering 2,813 vulnerabilities. [...] Sixteen newly published advisories included vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog (KEV) as they were actively exploited.”
- Partly supportedPHP2Shell flaws are among the report’s most concerning vulnerabilities.BleepingComputer: “The report also warns that the recently disclosed PHP2Shell vulnerabilities expose another weakness in network infrastructure”
- SupportedThe two PHP2Shell flaws allow unauthenticated remote code execution and put appliances such as firewalls, VPNs and storage devices at risk.BleepingComputer: “The two PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution”
- Not in the sourcesThe InfraTrust Pulse report was published on October 28.BleepingComputer: “The findings come from Eclypsium's October InfraTrust Pulse, a monthly report tracking security advisories affecting network devices, servers, firmware, chips, and other infrastructure.”
- SupportedThe report examined advisories affecting infrastructure between September 18 and October 14.BleepingComputer: “Between September 18 and October 14, InfraTrust tracked 133 new security advisories across 18 vendors, covering 2,813 vulnerabilities.”
- Partly supportedOf the 2,813 vulnerabilities, 37 were rated critical.BleepingComputer: “Between September 18 and October 14, InfraTrust tracked 133 new security advisories across 18 vendors, covering 2,813 vulnerabilities. Of those advisories, 37 were rated critical”
- SupportedSixteen advisories included vulnerabilities listed in CISA’s KEV catalog as actively exploited.BleepingComputer: “Sixteen newly published advisories included vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog (KEV) as they were actively exploited.”
- SupportedThe report highlights active exploitation of vulnerabilities in the named Citrix, Ivanti, Check Point, Cisco, Arista, Fortinet, F5 and Palo Alto Networks products.BleepingComputer: “Among the actively exploited flaws highlighted by InfraTrust are: Citrix NetScaler ADC and Gateway: [...] Ivanti Connect Secure: [...] Check Point Security Management Server:”
- SupportedPalo Alto Networks, F5, NetScaler, Check Point and QNAP confirmed that some products were affected and were developing fixes.BleepingComputer: “Soon after the disclosure, Palo Alto Networks, F5, NetScaler, Check Point, and QNAP confirmed that some of their products were affected, while they still developed fixes for appliances.”
- SupportedCopy Fail appears in 29 advisories across eight vendors, up from 19 advisories across six vendors the previous month.BleepingComputer: “CVE-2026-31431, a Linux kernel privilege escalation flaw known as Copy Fail, has now appeared in 29 advisories across eight vendors, up from 19 advisories from six vendors last month.”
