Attackers are actively exploiting critical vulnerabilities in network infrastructure, according to Eclypsium's October InfraTrust Pulse report. The monthly security advisory tracked 133 new advisories across 18 vendors between September 18 and October 14, covering 2,813 vulnerabilities. Among these, 37 were rated critical, five had a maximum CVSS score of 10.0, and 58 could be exploited remotely without authentication. Sixteen advisories involved vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog (KEV) as they were actively exploited.
The report highlights the risks posed by PHP flaws known as "PHP2Shell," which affect the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances. Because vendors compile PHP into appliance firmware, customers often cannot install security updates themselves and must wait for vendor-released firmware updates. InfraTrust recommends ensuring PHP-backed management interfaces are not exposed to the Internet while waiting for patches.
Some of the most serious vulnerabilities affect systems at the edge of enterprise networks or used to manage other infrastructure. Threat actors target these devices for initial access to corporate environments or as a springboard for further attacks. Actively exploited flaws include vulnerabilities in Citrix NetScaler ADC and Gateway, Ivanti Connect Secure, Check Point Security Management Server, Cisco Catalyst SD-WAN Manager, Arista VeloCloud Orchestrator, FortiMail, Cisco Secure Email Gateway, F5 BIG-IP APM, and PAN-OS management interface.
InfraTrust also warns that the PHP2Shell vulnerabilities expose another weakness in network infrastructure, as many appliances embed PHP directly into their management interfaces. The report recommends prioritizing patches for NetScaler and Ivanti Connect Secure, followed by updates for Fortinet's FortiOS, FortiManager, and FortiAnalyzer, as well as other affected systems.