Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk.

The findings come from Eclypsium's October InfraTrust Pulse, a monthly report tracking security advisories affecting network devices, servers, firmware, chips, and other infrastructure.

Between September 18 and October 14, InfraTrust tracked 133 new security advisories across 18 vendors, covering 2,813 vulnerabilities.

Of those advisories, 37 were rated critical, five had a maximum CVSS score of 10.0, and 58 could be exploited remotely without authentication.

Sixteen newly published advisories included vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog (KEV) as they were actively exploited.

The report also warns that many network appliances, including firewalls, VPN gateways, application delivery controllers, and network-attached storage devices, embed PHP into their management interfaces.

Because vendors compile PHP into appliance firmware, customers commonly cannot install the recent PHP security updates themselves and must instead wait for each vendor to release updated firmware.

InfraTrust therefore recommends that administrators make sure PHP-backed management interfaces are not exposed to the Internet while waiting for PHP2Shell patches.

Critical infrastructure under attack

Some of the most serious vulnerabilities affect systems at the edge of enterprise networks or used to manage other infrastructure.

Threat actors target these devices because they can provide initial access to corporate environments or serve as a springboard for further attacks.

Among the actively exploited flaws highlighted by InfraTrust are:

• Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 were disclosed on September 27 after attacks had already been observed against unpatched appliances. A separate NetScaler flaw, CVE-2026-88779, affecting appliances configured for SAML was also later added to CISA's KEV catalog after exploitation was detected.
• Ivanti Connect Secure: CVE-2026-104935 allows an unauthenticated remote attacker to execute arbitrary commands on vulnerable VPN gateways. Ivanti said it had exploited a limited number of customers when it published the advisory. CISA later added it to the KEV.
• Check Point Security Management Server: CVE-2026-93616 allows an unauthenticated attacker to upload and execute scripts on management and logging systems. Check Point Research observed targeted attacks exploiting the flaw on September 12, targeting Spark customers.
• Cisco Catalyst SD-WAN Manager: CVE-2026-76504 allows an unauthenticated attacker to bypass authentication and gain administrator access to the management API. Cisco became aware of active exploitation in September.
• Arista VeloCloud Orchestrator: CVE-2026-93952 is a maximum-severity flaw affecting the system used to configure SD-WAN Edge devices. Arista says it is being actively exploited and later disclosed a second, separate exploited vulnerability (CVE-2026-114625) in the same product on October 22.
• FortiMail: CVE-2026-104286 is a critical path traversal flaw that allows an unauthenticated attacker to write arbitrary files through the web interface. Fortinet confirmed it was exploited in attacks.
• Cisco Secure Email Gateway: CVE-2026-76519 can allow a malicious email attachment to lead to arbitrary file writes and command execution as root on vulnerable systems. Cisco learned of exploitation in October.
• F5 BIG-IP APM: CVE-2026-94127 is a critical heap overflow that can allow unauthenticated remote code execution on systems configured as OAuth authorization servers. F5 says the vulnerability has been exploited.
• PAN-OS management interface: Palo Alto Networks reported exploitation of CVE-2026-0322 in attacks on firewalls, allowing an authenticated administrator with network access to execute code as root.

php2shell exposes another problem

InfraTrust also warns that the recently disclosed PHP2Shell vulnerabilities expose another weakness in network infrastructure, as many appliances embed PHP directly into their management interfaces.

The two PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution, and the PHP project fixed them on October 21.

While most focus on these vulnerabilities has been on websites and web applications written in PHP, PHP is also used for management interfaces of firewalls, application delivery controllers, VPN appliances, and network-attached storage devices.

For impacted devices, administrators usually cannot update PHP themselves because vendors compile it directly into the appliance firmware. Instead, customers must wait for each vendor to rebuild and release updated firmware or software containing the patched PHP version.

Soon after the disclosure, Palo Alto Networks, F5, NetScaler, Check Point, and QNAP confirmed that some of their products were affected, while they still developed fixes for appliances.

The report also highlights a similar issue in other software components that infrastructure vendors bundle into their products.

CVE-2026-31431, a Linux kernel privilege escalation flaw known as Copy Fail, has now appeared in 29 advisories across eight vendors, up from 19 advisories from six vendors last month.

InfraTrust also found older, exploited vulnerabilities in bundled components, including an Android kernel flaw affecting HP LaserJet Enterprise printers and a 2020 jQuery vulnerability in Dell Data Lakehouse software.

InfraTrust recommends that administrators prioritize patching NetScaler and Ivanti Connect Secure because these remote-access gateways can serve as a doorway into corporate networks. Next, it recommends Fortinet's October 22 FortiOS, FortiManager, and FortiAnalyzer security updates for internet-facing devices.

The report then recommends focusing on Check Point Security Management Server, Cisco Catalyst SD-WAN Manager, VeloCloud Orchestrator, FortiMail, Cisco Secure Email Gateway, affected BIG-IP APM systems, and PAN-OS management interfaces.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report