InfraTrust report warns of exploited flaws in critical network infrastructure

PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two PHP vulnerabilities that allow unauthenticated remote code execution. An attacker does not need a login to run commands on a vulnerable system. That makes the flaws serious wherever PHP is exposed through a device’s management interface.

The risk extends beyond ordinary PHP websites. Vendors embed PHP into firmware for firewalls, VPN appliances, application delivery controllers, and network-attached storage devices. If the vulnerable interface is reachable, an attacker may send specially crafted requests that cause the appliance to execute commands remotely.

The PHP project fixed both flaws on October 21. However, appliance customers usually cannot update the embedded PHP installation themselves. They must wait for vendor firmware or software updates, so InfraTrust recommends keeping PHP-backed management interfaces off the Internet while patches are prepared.

The security problems were broad and concentrated across critical infrastructure products. Between September 18 and October 14, InfraTrust recorded 133 new security advisories from 18 vendors. Together, those advisories covered 2,813 vulnerabilities across network devices, servers, firmware, chips, and related infrastructure.

Severity was also high. Thirty-seven advisories were rated critical, and five vulnerabilities received the maximum CVSS score of 10.0. Fifty-eight vulnerabilities could be exploited remotely without authentication, removing a major barrier for attackers targeting exposed systems.

Active exploitation made the figures more urgent. Sixteen newly published advisories included vulnerabilities already listed in CISA’s Known Exploited Vulnerabilities catalog. The report therefore describes both a large volume of flaws and evidence that attackers were using some of them against real infrastructure.

Actively attacked devices included Citrix NetScaler appliances, Ivanti Connect Secure VPN gateways, Check Point Security Management Server, Cisco Catalyst SD-WAN Manager, Arista VeloCloud Orchestrator, FortiMail, Cisco Secure Email Gateway, F5 BIG-IP APM, and PAN-OS management interfaces. These products sit at network edges or help manage other systems.

The weaknesses provided powerful access. Ivanti’s CVE-2026-104935 enabled unauthenticated command execution. Cisco’s CVE-2026-76504 bypassed authentication and granted administrator access to the management API. Check Point’s CVE-2026-93616 allowed script upload and execution. Other flaws enabled remote code execution, arbitrary file writes, or code execution as root.

The attacks were not merely theoretical. Vendors and researchers reported exploitation against unpatched appliances, VPN gateways, management systems, email gateways, firewalls, and SD-WAN infrastructure. Several vulnerabilities were later added to CISA’s KEV catalog after exploitation was detected.

Compromising an Internet-facing firewall, VPN gateway, or management server can give attackers a foothold at a critical boundary. InfraTrust says threat actors target these systems because they can provide initial access to corporate environments or act as springboards for further attacks.

The immediate consequences depend on the vulnerability. An attacker might execute commands on a VPN gateway, bypass authentication to obtain administrator access, upload and run scripts, write arbitrary files, or execute code as root. Such capabilities can let attackers alter device behavior or use its trusted position to reach additional systems.

The article does not claim that every compromise produces the same result. It does show repeated exploitation across edge and management products, including firewalls, email gateways, SD-WAN systems, and VPNs. Internet exposure, missing patches, and powerful management functions make these devices especially consequential when breached.

Many network appliances do not use PHP as a separately managed package. Vendors compile PHP directly into the firmware that runs the device. That design ties the PHP code to the appliance’s broader software image, rather than giving customers an independent PHP component to update.

As a result, administrators usually cannot install the latest PHP security release themselves. Updating only part of the embedded software could be unsupported or impossible. For PHP2Shell, the PHP project fixed the flaws on October 21, but appliance owners still need each vendor to rebuild and release firmware or software containing the patched version.

This creates a timing gap between a central PHP fix and protection for individual devices. During that gap, organizations must monitor vendor advisories and reduce exposure. InfraTrust specifically recommends ensuring PHP-backed management interfaces are not exposed to the Internet while waiting for patches.

Administrators should make sure PHP-backed management interfaces are not exposed to the Internet while waiting for PHP2Shell patches. This recommendation directly reduces the chance that unauthenticated attackers can reach the vulnerable interface from outside the organization.

The advice matters because many firewalls, VPN appliances, application delivery controllers, and network-attached storage devices embed PHP in their management interfaces. Customers generally cannot patch that PHP installation independently. The PHP project fixed CVE-2026-109618 and CVE-2026-109619 on October 21, but the appliance still needs a vendor-provided firmware or software update.

The article does not provide a broader list of interim controls. It specifically emphasizes removing Internet exposure and waiting for vendor fixes. Administrators should therefore track updates from the relevant appliance vendors and apply the rebuilt firmware or software when released.

A management interface is the web-based control surface through which administrators manage a firewall, VPN gateway, application delivery controller, storage device, or similar appliance. The article describes these interfaces as places where PHP is commonly embedded. They are part of the device’s operational software, not ordinary public content.

That makes them valuable targets. A flaw in the interface can let an attacker interact with functions intended for administrators. The reported examples include authentication bypass, administrator access, script upload and execution, arbitrary file writing, command execution, and remote code execution. Some attacks required no authentication at all.

These interfaces are especially attractive when exposed at the network edge. Attackers can target them directly, then use the compromised appliance for initial access or as a springboard into other infrastructure. PHP2Shell highlights the added risk because customers may need vendor firmware before they can patch the interface’s embedded PHP.