Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

Between September 18 and October 14, 2026, InfraTrust's October Pulse report documented 133 security advisories across 18 vendors covering 2,813 vulnerabilities in critical network infrastructure. Sixteen advisories included actively exploited flaws added to CISA's Known Exploited Vulnerabilities catalog, targeting edge devices including Citrix NetScaler, Ivanti Connect Secure, Check Point Security Management Server, Cisco SD-WAN, Arista VeloCloud, FortiMail, F5 BIG-IP APM, and PAN-OS. Attackers leveraged unauthenticated remote code execution, authentication bypass, and path traversal flaws to gain initial access and pivot into enterprise networks. The PHP2Shell vulnerabilities further compounded risk by exposing management interfaces of firewalls, VPN appliances, and application delivery controllers to unauthenticated RCE.

This wave of infrastructure exploitation reflects a maturing initial-access-broker ecosystem where edge appliances serve as primary entry points. With threat actors including nation-state groups systematically targeting network management planes, organizations face compounding risk from unpatched vendor firmware cycles that delay PHP2Shell and Linux kernel fixes beyond enterprise control.

Why This Matters Now

Sixteen actively exploited CVEs across critical edge infrastructure were disclosed in a single month, with PHP2Shell flaws now embedded in firewall and VPN firmware that only vendors—not customers—can patch. As attackers increasingly chain unauthenticated RCE on perimeter appliances with lateral movement, organizations relying solely on perimeter defenses face an unacceptably wide exposure window until vendor patches arrive.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two critical PHP flaws enabling unauthenticated remote code execution. Because vendors compile PHP directly into appliance firmware for management interfaces, customers cannot patch independently and must wait for vendor-issued firmware updates, leaving firewalls, VPN gateways, and application delivery controllers exposed during the remediation window.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this campaign because attackers exploited perimeter appliance vulnerabilities to gain footholds and then moved freely across internal segments with little enforcement in their path. By enforcing segmentation, restricting management interface reachability, and controlling outbound paths, CNSF would likely have reduced the attacker's ability to pivot, persist, and exfiltrate across the compromised infrastructure estate.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Inline IPS signature detection and access controls on management interfaces would likely have reduced the reachability of exploit traffic targeting these appliances, limiting the attacker's ability to land initial footholds across the perimeter device estate.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Identity-aware segmentation policies enforced at the workload level would likely have reduced the blast radius of privilege escalation by limiting what compromised appliance processes could reach, even after an attacker gained elevated access on the device itself.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west segmentation policies enforcing workload-to-workload access controls would likely have limited how far a compromised edge device could reach into internal segments, reducing the attacker's ability to pivot freely toward high-value targets like identity providers and domain controllers.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized traffic observability across the hybrid environment would likely have surfaced anomalous outbound communication patterns and unusual management API interactions from compromised devices, reducing the time attackers could operate undetected across the multicloud and on-premises estate.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: FQDN-based egress filtering and outbound traffic policy enforcement would likely have constrained the ability of compromised appliances to send data to unauthorized external destinations, reducing the volume and reach of successful exfiltration attempts.

Impact (Mitigations)

Where prior CNSF controls constrained lateral movement, egress paths, and C2 reachability, the residual impact would likely have been scoped to the initially compromised appliances rather than propagating broadly across internal segments, identity systems, and downstream enterprise targets.

Impact at a Glance

Affected Business Functions

  • Network Perimeter and Edge Security Operations
  • VPN and Remote Access Services
  • Corporate Email and Communications Infrastructure
  • SD-WAN and Wide Area Network Management
Operational Disruption

Estimated downtime: 14 days

Financial Impact

Estimated loss: N/A

Data Exposure

The exploitation of vulnerabilities across firewalls, VPN gateways, application delivery controllers, SD-WAN orchestrators, and email security gateways places at risk highly sensitive categories of enterprise data including: corporate network credentials and authentication tokens harvested from VPN and ADC appliances; email content, attachments, and metadata traversing compromised email gateways; SD-WAN configuration data revealing network topology and routing; management credentials for downstream infrastructure; and potentially regulated data (PII, financial records, health information) transiting through compromised perimeter devices. The PHP2Shell vulnerabilities additionally expose management plane access across a broad ecosystem of appliances where patching is deferred to vendor firmware release cycles, extending the window of exposure across hundreds to thousands of enterprise deployments. Initial Access Broker activity implied by the threat category suggests harvested credentials and network access are likely being monetized or sold, amplifying downstream breach risk.

Recommended Actions

  • • Deploy Cloud Firewall (ACF) and Inline IPS (Suricata) to restrict internet exposure of PHP-backed management interfaces on all network appliances immediately, blocking unauthenticated exploit attempts against CVE-2026-109618/19 and device-specific CVEs while vendor firmware patches are pending.
  • • Enforce Zero Trust Segmentation and East-West Traffic Security controls to microsegment edge appliances from internal networks, ensuring that a compromised VPN gateway, ADC, or SD-WAN orchestrator cannot directly pivot to internal identity providers, domain controllers, or application servers.
  • • Activate Multicloud Visibility and Control with centralized traffic observability and anomaly detection across hybrid and multi-cloud environments to flag anomalous management API calls, unusual outbound connections, and lateral movement patterns originating from edge infrastructure devices.
  • • Implement Egress Security and Policy Enforcement with FQDN-based filtering on all outbound traffic from network appliances and workloads, blocking communication to unauthorized destinations and limiting data exfiltration channels from compromised devices.
  • • Deploy Encrypted Traffic (HPE) using MACsec and IPsec for all data-in-transit traversing VPN gateways and ADCs, ensuring that even if appliances are compromised, intercepted traffic cannot be read in plaintext, directly mitigating Salt Typhoon-style passive interception risks on private circuits.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image