InfraTrust report warns of exploited flaws in critical network infrastructure
Attackers exploit critical network infrastructure flaws, including PHP2Shell, impacting firewalls and VPNs.
A new report from Eclypsium's InfraTrust highlights active exploitation of vulnerabilities in critical network infrastructure, particularly those affecting web management interfaces of devices like firewalls and VPNs due to embedded PHP flaws. The report tracked 133 advisories, with many critical vulnerabilities being exploited remotely without authentication, and several already added to CISA's KEV catalog. Administrators are advised to prevent internet exposure of PHP-backed interfaces while awaiting vendor patches.
AI summary of the linked source. Not reviewed by an editor. How this works
Run NetScaler ADC?
Get an email when a new story names NetScaler ADC, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are actively exploiting embedded PHP vulnerabilities in the web management interfaces of firewalls, VPNs, and other critical network infrastructure devices — many without requiring any authentication. The Eclypsium InfraTrust report tracked 133 advisories, with numerous critical CVEs already added to CISA's Known Exploited Vulnerabilities catalog, indicating real-world harm is already occurring. The core problem is a dangerous combination of unpatched software, internet-exposed management interfaces, and slow vendor patch cycles. This matters because these are the devices that protect everything else — compromising them can hand attackers full network visibility and control before defenders even know an intrusion has begun.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- External attack surface management (EASM)
You find your forgotten internet-facing systems before attackers do.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-88771
- cve — CVE-2026-88772
- cve — CVE-2026-88779
- cve — CVE-2026-104935
- cve — CVE-2026-93616
- cve — CVE-2026-76504
- cve — CVE-2026-93952
- cve — CVE-2026-114625
- cve — CVE-2026-104286
- cve — CVE-2026-76519
- cve — CVE-2026-94127