GoKawiilEclypsium report finds active exploitation of PHP flaws in network appliances
Eclypsium's October InfraTrust Pulse report tracked 133 new security advisories across 18 vendors between September 18 and October 14, covering 2,813 vulnerabilities, with 37 rated critical and 58 exploitable remotely without authentication. The report highlights so-called PHP2Shell flaws affecting PHP code embedded in the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances, noting that 16 advisories involved vulnerabilities already listed in CISA's Known Exploited Vulnerabilities catalog.
GoKawiil's interpretation of the reporting above, not reported fact.
Because vendors compile PHP directly into appliance firmware, customers cannot apply PHP's own security patches and must wait for each vendor to issue updated firmware, which could leave exposed devices vulnerable for extended periods. Eclypsium's recommendation that administrators restrict internet exposure of PHP-backed management interfaces suggests the firm views this as an urgent stopgap rather than a full fix. The pattern also underscores how edge devices like firewalls and VPN gateways remain attractive targets for attackers seeking initial network access.
- Eclypsium tracked 2,813 vulnerabilities across 18 vendors in a one-month window, with 37 rated critical.
- PHP2Shell flaws affect PHP embedded in firmware of firewalls, VPNs, and application delivery controllers, which vendors—not customers—must patch.
- 16 advisories involved vulnerabilities already confirmed as actively exploited per CISA's KEV catalog.
YubiKey 5 NFC Security Key — With critical network infrastructure like firewalls and VPNs under active attack, strengthening authentication on management interfaces is more important than ever. A YubiKey adds hardware-based multi-factor authentication to admin accounts, making it far harder for attackers to exploit stolen credentials even if a vulnerability is exploited. It's a simple, concrete step network admins can take right now while waiting on vendor patches.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-28
Published there as: “InfraTrust report warns of exploited flaws in critical network infrastructure”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.