Eclypsium's InfraTrust Pulse Report Warns of Actively Exploited Flaws in Critical Network Infrastructure
Eclypsium's October InfraTrust Pulse report tracks 133 new security advisories covering 2,813 vulnerabilities, many of them actively exploited, and warns that PHP flaws known as PHP2Shell put the management interfaces of firewalls, VPNs, and other network appliances at risk.
BleepingComputer
Attackers are actively exploiting vulnerabilities across critical network infrastructure, according to Eclypsium's October InfraTrust Pulse, a monthly report that tracks security advisories affecting network devices, servers, firmware, chips, and other infrastructure components.
Between September 18 and October 14, InfraTrust tracked 133 new security advisories from 18 vendors covering 2,813 vulnerabilities. Of those advisories, 37 were rated critical, five carried the maximum CVSS score of 10.0, and 58 could be exploited remotely without authentication. Sixteen newly published advisories included vulnerabilities listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as being actively exploited.
The report pays particular attention to a set of PHP vulnerabilities dubbed PHP2Shell, which expose a structural weakness in network appliances. The two flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution and were fixed by the PHP project on October 21. While most attention on these vulnerabilities has focused on websites and web applications written in PHP, the report notes that PHP is also embedded in the management interfaces of firewalls, application delivery controllers, VPN appliances, and network-attached storage devices.
Because vendors compile PHP directly into appliance firmware, customers generally cannot install the recent PHP security updates themselves. Instead, they must wait for each vendor to rebuild and release updated firmware or software containing the patched PHP version. Soon after the disclosure, Palo Alto Networks, F5, NetScaler, Check Point, and QNAP confirmed that some of their products were affected while they continued developing fixes for their appliances.
Until patched firmware becomes available, InfraTrust recommends that administrators ensure PHP-backed management interfaces are not exposed to the Internet.
The report also highlights a related problem in other software components that infrastructure vendors bundle into their products. CVE-2026-31431, a Linux kernel privilege escalation flaw known as Copy Fail, has now appeared in 29 advisories across eight vendors, up from 19 advisories from six vendors the previous month. InfraTrust also identified older exploited vulnerabilities in bundled components, including an Android kernel flaw affecting HP LaserJet Enterprise printers and a 2020 jQuery vulnerability in Dell Data Lakehouse software.
InfraTrust notes that some of the most serious vulnerabilities affect systems at the edge of enterprise networks or used to manage other infrastructure. Threat actors target these devices because they can provide initial access to corporate environments or serve as a springboard for further attacks.
To help administrators prioritize, the report recommends patching NetScaler and Ivanti Connect Secure first, since these remote-access gateways can serve as a doorway into corporate networks. Next, it points to Fortinet's October 22 security updates for FortiOS, FortiManager, and FortiAnalyzer for internet-facing devices. The report then recommends focusing on Check Point Security Management Server, Cisco Catalyst SD-WAN Manager, VeloCloud Orchestrator, FortiMail, Cisco Secure Email Gateway, affected BIG-IP APM systems, and PAN-OS management interfaces.
The report also cautions that overall prevention scores can hide what happens after initial access, observing that once attackers are operating with valid credentials, prevention rates drop sharply. The Blue Report 2026, referenced in the findings, measures defenses technique by technique across 338 million simulations run in customer production environments.