SecOraLens
CriticalCVE

InfraTrust report warns of exploited flaws in critical network infrastructure

BleepingComputer·Source published ·1 min read

What happened?

Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. [...]

Key details

  • Eclypsium InfraTrust Pulse tracked 133 new advisories across 18 vendors covering 2,813 vulnerabilities between September 18 and October 14.
  • Thirty-seven advisories were rated critical, five reached maximum CVSS 10.0, and 58 allowed remote unauthenticated exploitation.
  • Sixteen newly published advisories included vulnerabilities already listed in CISA's Known Exploited Vulnerabilities catalog.
  • Many network appliances embed PHP in management interfaces, and customers cannot update PHP themselves because vendors compile it into firmware.
  • PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution and were fixed by the PHP project on October 21.
  • Palo Alto Networks, F5, NetScaler, Check Point, and QNAP confirmed some products are affected by PHP2Shell while developing fixes.
  • InfraTrust recommends prioritizing patching of NetScaler and Ivanti Connect Secure gateways, then Fortinet October 22 updates for internet-facing devices.

Affected

  • Citrix NetScaler ADC and Gateway appliances.
  • Ivanti Connect Secure VPN gateways.
  • Check Point Security Management Server.
  • Cisco Catalyst SD-WAN Manager.
  • Arista VeloCloud Orchestrator.
  • Cisco Secure Email Gateway.

Fixes and mitigations

  1. PHP project fixed PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 on October 21.
  2. Vendors must rebuild and release updated firmware containing patched PHP for affected appliances.
  3. InfraTrust recommends administrators ensure PHP-backed management interfaces are not exposed to the Internet while waiting for patches.
  4. Fortinet released FortiOS, FortiManager, and FortiAnalyzer security updates on October 22 for internet-facing devices.

Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories