InfraTrust report warns of exploited flaws in critical network infrastructure

Eclypsium's October InfraTrust Pulse report shows that attackers are actively abusing flaws in widely used network appliances, logging 133 new advisories across 18 vendors covering 2,813 vulnerabilities between September 18 and October 14. Of these, 37 were critical, five scored a maximum 10.0 CVSS, and 16 advisories contained bugs already listed in CISA's Known Exploited Vulnerabilities catalog, including Citrix NetScaler (CVE-2026-88771, CVE-2026-88772, CVE-2026-88779), Ivanti Connect Secure (CVE-2026-104935), Check Point Security Management Server (CVE-2026-93616), Cisco Catalyst SD-WAN Manager (CVE-2026-76504), Arista VeloCloud Orchestrator (CVE-2026-93952 and CVE-2026-114625), FortiMail (CVE-2026-104286), Cisco Secure Email Gateway (CVE-2026-76519), F5 BIG-IP APM (CVE-2026-94127), and PAN-OS management interfaces (CVE-2026-0322). The report also flags the newly disclosed "PHP2Shell" bugs (CVE-2026-109618 and CVE-2026-109619), which affect PHP code embedded in management interfaces of firewalls, VPNs, application delivery controllers, and NAS devices; since vendors compile PHP into their firmware, customers can't patch it directly and must wait for vendor firmware updates, so InfraTrust urges blocking internet exposure of these interfaces in the meantime. A Linux kernel escalation bug dubbed "Copy Fail" (CVE-2026-31431) has also spread to 29 advisories from 8 vendors, up sharply from last month, underscoring how shared components amplify risk across the infrastructure ecosystem.