[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6ZmV02Pw3KvewAv293OYJ9PRLY30Quj2tDFjXKfazXk":3},{"article":4,"iocs":53,"watch_terms":86,"solutions":87,"lesson":181},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"701d959d-6a66-4bcc-8e26-43cf9c2d1a09","InfraTrust report warns of exploited flaws in critical network infrastructure","infratrust-report-warns-of-exploited-flaws-in-critical-network-infrastructure-f2c961","Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as \"PHP2Shell\" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. [...]","A new report from Eclypsium's InfraTrust highlights active exploitation of vulnerabilities in critical network infrastructure, particularly those affecting web management interfaces of devices like firewalls and VPNs due to embedded PHP flaws. The report tracked 133 advisories, with many critical vulnerabilities being exploited remotely without authentication, and several already added to CISA's KEV catalog. Administrators are advised to prevent internet exposure of PHP-backed interfaces while awaiting vendor patches.","Attackers exploit critical network infrastructure flaws, including PHP2Shell, impacting firewalls and VPNs.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Finfratrust-report-warns-of-exploited-flaws-in-critical-network-infrastructure\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F21\u002Finfratrust.jpg","2026-10-28T14:00:00+00:00","2026-10-28T15:00:13.383264+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"NetScaler ADC","product",{"name":21,"type":19},"NetScaler Gateway",{"name":23,"type":19},"Connect Secure",{"name":25,"type":19},"Security Management Server",{"name":27,"type":19},"Catalyst SD-WAN Manager",{"name":29,"type":19},"VeloCloud Orchestrator","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[54,58,60,63,66,69,72,75,77,80,83],{"type":55,"value":56,"context":57},"cve","CVE-2026-88771","Citrix NetScaler ADC and Gateway vulnerability",{"type":55,"value":59,"context":57},"CVE-2026-88772",{"type":55,"value":61,"context":62},"CVE-2026-88779","Citrix NetScaler vulnerability affecting SAML configurations",{"type":55,"value":64,"context":65},"CVE-2026-104935","Ivanti Connect Secure vulnerability",{"type":55,"value":67,"context":68},"CVE-2026-93616","Check Point Security Management Server vulnerability",{"type":55,"value":70,"context":71},"CVE-2026-76504","Cisco Catalyst SD-WAN Manager vulnerability",{"type":55,"value":73,"context":74},"CVE-2026-93952","Arista VeloCloud Orchestrator vulnerability",{"type":55,"value":76,"context":74},"CVE-2026-114625",{"type":55,"value":78,"context":79},"CVE-2026-104286","FortiMail vulnerability",{"type":55,"value":81,"context":82},"CVE-2026-76519","Cisco Secure Email Gateway vulnerability",{"type":55,"value":84,"context":85},"CVE-2026-94127","F5 BIG-IP APM vulnerability",[18,21,23],{"controls":88,"vendors":169},[89,118,140],{"slug":90,"name":91,"problem":92,"products":93},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":119,"name":120,"problem":121,"products":122},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"detectify","Detectify","\u002Fvendor-logos\u002Fdetectify.png","surface-monitoring","Detectify Surface Monitoring","https:\u002F\u002Fdetectify.com\u002Fproduct\u002Fsurface-monitoring","Continuous discovery and testing of internet-facing subdomains and services.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xpanse","Cortex Xpanse","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xpanse","External attack surface discovery and remediation.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},{"slug":141,"name":142,"problem":143,"products":144},"patch-management","Automated patch management","Known holes get closed in days, not months.",[145,153,161],{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":162,"vendor_name":163,"vendor_logo":164,"product_slug":165,"product_name":166,"url":167,"description":168},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[170,176],{"slug":171,"name":172,"logo_path":173,"roles":174},"citrix","Citrix","\u002Fvendor-logos\u002Fcitrix.png",[175],"affected",{"slug":177,"name":178,"logo_path":179,"roles":180},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png",[175],{"slug":182,"title":183,"body":184,"framework_refs":185,"framework_notes":193},"critical-network-device-flaws-actively-exploited-via-exposed-web-interfaces","Critical Network Device Flaws Actively Exploited via Exposed Web Interfaces","Attackers are actively exploiting embedded PHP vulnerabilities in the web management interfaces of firewalls, VPNs, and other critical network infrastructure devices — many without requiring any authentication. The Eclypsium InfraTrust report tracked 133 advisories, with numerous critical CVEs already added to CISA's Known Exploited Vulnerabilities catalog, indicating real-world harm is already occurring. The core problem is a dangerous combination of unpatched software, internet-exposed management interfaces, and slow vendor patch cycles. This matters because these are the devices that protect everything else — compromising them can hand attackers full network visibility and control before defenders even know an intrusion has begun.",[186,187,188,189,190,191,192],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":194,"NIST SP 800-53 SI-2: Flaw Remediation":195,"CIS Control 17: Incident Response Management":196,"OWASP A06:2021 Vulnerable and Outdated Components":197,"CIS Control 7: Continuous Vulnerability Management":198,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":199,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":200},"NIS2 requires essential and important entities to implement vulnerability handling and disclosure policies for their networks; the exploitation of unpatched management interfaces on critical infrastructure directly falls within this obligation.","SI-2 requires organisations to identify, report, and correct information system flaws on defined timelines; a formal flaw remediation process would have driven urgent patching of the PHP vulnerabilities before attackers could exploit them remotely without authentication.","With active exploitation already confirmed and CVEs listed in KEV, organisations need a rehearsed incident response capability to contain compromised network devices quickly and limit lateral movement across the environment.","The embedded PHP flaws in vendor firmware are a direct example of vulnerable and outdated components shipping inside critical infrastructure products, exactly the risk OWASP A06 asks organisations to track and remediate.","With 133 tracked advisories and many already in CISA KEV, a continuous vulnerability scanning and remediation programme would have identified and prioritised these flaws before active exploitation reached production devices.","This control requires timely identification and remediation of technical vulnerabilities in information assets; applying it to network perimeter devices would have mandated tracking vendor advisories and applying mitigations while awaiting patches.","Several vulnerabilities allowed unauthenticated remote exploitation; enforcing strict access control on management interfaces — as PR.AA demands — would have prevented or significantly limited attacker reach even in the absence of a vendor patch."]