Eclypsium InfraTrust Pulse: 16 advisories with KEV-listed flaws across edge devices; PHP2Shell leaves appliances unpatchable

Entenda a falha

A vulnerabilidade

The story is a roundup of exploited edge and management flaws, not one bug. Arista VeloCloud Orchestrator CVE-2026-93952 is maximum severity and exploited, and CVE-2026-114625 was disclosed October 22. F5 BIG-IP APM CVE-2026-94127 is a heap overflow giving unauthenticated RCE when configured as an OAuth authorization server. Ivanti Connect Secure CVE-2026-104935, Check Point Security Management Server CVE-2026-93616 (script upload and execution) and the PHP flaws CVE-2026-109618 and CVE-2026-109619 (PHP2Shell, fixed by the PHP project October 21) are unauthenticated RCE. Cisco SD-WAN Manager CVE-2026-76504 is an authentication bypass to admin API access. FortiMail CVE-2026-104286 is a path traversal with arbitrary file writes. Cisco Secure Email Gateway CVE-2026-76519 gives root command execution via a malicious attachment. PAN-OS CVE-2026-0322 needs an authenticated admin with network access and gives root. NetScaler CVE-2026-88771, CVE-2026-88772 and CVE-2026-88779 (SAML configurations) are also exploited. The articles give no affected or fixed version numbers.

Como funciona

The articles describe the mechanisms only briefly. For PHP2Shell, a remote unauthenticated request reaches PHP code that vendors compile into the appliance firmware to run the web management interface, and the PHP flaws allow code execution there. In FortiMail, input to the web interface lets an unauthenticated attacker write files outside the intended location. In Cisco Secure Email Gateway, a malicious attachment processed by the system leads to arbitrary file writes and then root command execution. In BIG-IP APM, the heap overflow is reached on systems acting as OAuth authorization servers. In Cisco SD-WAN Manager, the authentication check can be bypassed to reach the management API. The articles do not give finer step-by-step detail.

Por que é vulnerável

The articles name root causes only in part: a heap overflow in BIG-IP APM, path traversal in FortiMail, missing authentication or an authentication bypass in the Cisco SD-WAN Manager, Ivanti and Check Point cases, and unauthenticated RCE in PHP. For the other CVEs, no root cause is described. The structural problem for PHP2Shell is that vendors compile PHP into appliance firmware, so customers cannot update it and must wait for vendor-rebuilt firmware. The same pattern affects other bundled components: the Linux kernel flaw CVE-2026-31431 (Copy Fail) now appears in 29 advisories across eight vendors, and old bundled bugs such as a 2020 jQuery flaw in Dell Data Lakehouse remain exploitable. The articles do not detail what each fix changes.

Como foi descoberta

The overview comes from Eclypsium's October InfraTrust Pulse, covering 133 advisories from 18 vendors between September 18 and October 14. Most flaws came to light through exploitation in the wild, and sixteen advisories included flaws listed in CISA's KEV. Check Point Research saw targeted attacks on Spark customers on September 12. Ivanti said a limited number of customers were exploited when it published its advisory. Cisco said it learned of exploitation of CVE-2026-76504 in September and of CVE-2026-76519 in October. NetScaler CVE-2026-88771 and CVE-2026-88772 were disclosed September 27 after attacks on unpatched appliances. Fortinet, Arista, F5 and Palo Alto Networks reported or confirmed exploitation. The PHP project fixed PHP2Shell on October 21, and Palo Alto Networks, F5, NetScaler, Check Point and QNAP then confirmed some products are affected.

Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 12:17.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

1. exploit-db.com · EDB-52704 ↗ · remoto · php · pub. 22/10/2026 verificado

   PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

   This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.

   CVE-2026-109618 · autor: OffSec · explicação gerada por IA

Detalhes técnicos

Remediação