InfraTrust hisoboti muhim tarmoq infratuzilmasidagi foydalanilayotgan zaifliklar haqida ogohlantiradi

Hujumchilar muhim tarmoq infratuzilmasi bo'ylab zaifliklardan faol foydalanmoqda, "PHP2Shell" deb nomlanuvchi PHP kamchiliklari esa xavfsizlik devorlari, VPN, ilovalarni yetkazib berish kontrollerlari va boshqa qurilmalarning veb-boshqaruv interfeyslarini xavf ostiga qo'ymoqda.

Topilmalar Eclypsium'ning oktyabr oyidagi InfraTrust Pulse hisobotidan kelib chiqqan — bu tarmoq qurilmalari, serverlar, proshivka, chiplar va boshqa infratuzilma xavfsizlik maslahatlarini kuzatuvchi oylik hisobotdir.

18-sentabrdan 14-oktyabrgacha InfraTrust 18 ta sotuvchi bo'yicha 2 813 ta zaiflikni qamrab olgan 133 ta yangi xavfsizlik maslahatini kuzatdi.

Ushbu maslahatlardan 37 tasi jiddiy deb baholangan, beshtasi maksimal CVSS balli 10,0 ga ega, 58 tasi esa autentifikatsiyasiz masofadan foydalanish mumkin.

Yangi e'lon qilingan 16 ta maslahat CISA'ning Ma'lum Foydalanilgan Zaifliklar katalogida (KEV) ro'yxatga olingan zaifliklarni o'z ichiga olgan, chunki ular faol foydalanilmoqda.

Hisobot shuningdek, ko'plab tarmoq qurilmalari — xavfsizlik devorlari, VPN shlyuzlari, ilovalarni yetkazib berish kontrollerlari va tarmoqqa ulangan saqlash qurilmalari — o'z boshqaruv interfeyslariga PHP ni o'rnatganini ogohlantiradi.

Sotuvchilar PHP ni qurilma proshivkasiga kompilyatsiya qilganligi sababli, mijozlar odatda so'nggi PHP xavfsizlik yangilanishlarini o'zlari o'rnatolmaydi va har bir sotuvchidan yangilangan proshivka chiqarilishini kutishlari kerak.

Shuning uchun InfraTrust PHP2Shell yamog'lari kutilayotganda PHP bilan ishlaydigan boshqaruv interfeyslarini Internetga ochiq qoldirmaslikni tavsiya qiladi.

Muhim infratuzilma hujum ostida

Eng jiddiy zaifliklardan ba'zilari korporativ tarmoqlarning chekkasida joylashgan tizimlarga yoki boshqa infratuzilmani boshqarish uchun ishlatiladigan tizimlarga ta'sir qiladi.

Tahdid aktorlari ushbu qurilmalarni nishonga oladi, chunki ular korporativ muhitlarga dastlabki kirish imkoniyatini berishi yoki keyingi hujumlar uchun sakrash nuqtasi bo'lib xizmat qilishi mumkin.

InfraTrust tomonidan ta'kidlangan faol foydalanilayotgan zaifliklar orasida:

• Citrix NetScaler ADC va Gateway: CVE-2026-88771 va CVE-2026-88772 27-sentabrda e'lon qilindi, chunki yamalmagan qurilmalarga qarshi hujumlar allaqachon kuzatilgan edi. SAML uchun sozlangan qurilmalarga ta'sir qiluvchi alohida NetScaler zaifligi CVE-2026-88779 ham keyinchalik foydalanish aniqlangandan so'ng CISA KEV katalogiga qo'shildi.
• Ivanti Connect Secure: CVE-2026-104935 autentifikatsiyasiz masofaviy hujumchiga zaif VPN shlyuzlarida ixtiyoriy buyruqlarni bajarish imkonini beradi. Ivanti maslahat e'lon qilinganda cheklangan miqdordagi mijozlar hujumga uchraganini aytdi. Keyinchalik CISA uni KEV ga qo'shdi.
• Check Point Security Management Server: CVE-2026-93616 autentifikatsiyasiz hujumchiga boshqaruv va jurnal tizimlarida skriptlarni yuklash va bajarish imkonini beradi. Check Point Research 12-sentabrda Spark mijozlarini nishonga olgan hujumlarda ushbu zaiflikdan foydalanishni kuzatdi.
• Cisco Catalyst SD-WAN Manager: CVE-2026-76504 autentifikatsiyasiz hujumchiga autentifikatsiyani chetlab o'tish va boshqaruv API ga administrator kirishini olish imkonini beradi. Cisco sentabrda faol foydalanishdan xabardor bo'ldi.
• Arista VeloCloud Orchestrator: CVE-2026-93952 SD-WAN Edge qurilmalarini sozlash uchun ishlatiladigan tizimga ta'sir qiluvchi maksimal jiddiylikdagi zaiflikdir. Arista u faol foydalanilayotganini aytdi va keyinchalik 22-oktyabrda xuddi shu mahsulotda ikkinchi, alohida foydalanilayotgan zaiflikni (CVE-2026-114625) e'lon qildi.
• FortiMail: CVE-2026-104286 jiddiy yo'l o'tish zaifligi bo'lib, autentifikatsiyasiz hujumchiga veb-interfeys orqali ixtiyoriy fayllarni yozish imkonini beradi. Fortinet u hujumlarda foydalanilganini tasdiqladi.
• Cisco Secure Email Gateway: CVE-2026-76519 zararli elektron pochta ilovasi zaif tizimlarda ixtiyoriy fayl yozish va root sifatida buyruq bajarishga olib kelishi mumkin. Cisco oktyabrda foydalanishdan xabardor bo'ldi.
• F5 BIG-IP APM: CVE-2026-94127 jiddiy heap to'lib ketishi bo'lib, OAuth avtorizatsiya serverlari sifatida sozlangan tizimlarda autentifikatsiyasiz masofaviy kod bajarishga imkon beradi. F5 zaiflikdan foydalanilganini aytdi.
• PAN-OS boshqaruv interfeysi: Palo Alto Networks xavfsizlik devorlarida CVE-2026-0322 dan foydalanishni e'lon qildi, bu tarmoq kirishiga ega autentifikatsiyalangan administratorga root sifatida kod bajarish imkonini beradi.

php2shell yana bir muammoni ochib beradi

InfraTrust shuningdek, yaqinda e'lon qilingan PHP2Shell zaifliklari tarmoq infratuzilmasida yana bir zaiflikni ochib berishini ogohlantiradi, chunki ko'plab qurilmalar o'z boshqaruv interfeyslariga PHP ni to'g'ridan-to'g'ri o'rnatgan.

Ushbu ikki PHP zaifligi — CVE-2026-109618 va CVE-2026-109619 — autentifikatsiyasiz masofaviy kod bajarishga imkon beradi va PHP loyihasi ularni 21-oktyabrda tuzatdi.

Ushbu zaifliklarga ko'p e'tibor PHP da yozilgan veb-saytlar va veb-ilovalarga qaratilgan bo'lsa-da, PHP shuningdek xavfsizlik devorlari, ilovalarni yetkazib berish kontrollerlari, VPN qurilmalari va tarmoqqa ulangan saqlash qurilmalarining boshqaruv interfeyslari uchun ham ishlatiladi.

Ta'sirlangan qurilmalar uchun administratorlar odatda PHP ni o'zlari yangilay olmaydi, chunki sotuvchilar uni to'g'ridan-to'g'ri qurilma proshivkasiga kompilyatsiya qilgan. Buning o'rniga, mijozlar har bir sotuvchidan yamalgan PHP versiyasini o'z ichiga olgan yangilangan proshivka yoki dasturiy ta'minotni qayta qurish va chiqarishni kutishlari kerak.

E'lon qilingandan ko'p o'tmay, Palo Alto Networks, F5, NetScaler, Check Point va QNAP o'z mahsulotlarining ba'zilari ta'sirlanganini tasdiqladi, ammo qurilmalar uchun tuzatishlar hali ishlab chiqilmoqda.

Hisobot shuningdek, infratuzilma sotuvchilari o'z mahsulotlariga o'rnatgan boshqa dasturiy komponentlarda ham shunga o'xshash muammoni ta'kidlaydi.

Copy Fail deb nomlanuvchi Linux yadrosi imtiyozlarini oshirish zaifligi CVE-2026-31431 endi sakkizta sotuvchining 29 ta maslahatida paydo bo'ldi, bu o'tgan oydagi oltita sotuvchining 19 ta maslahatidan ko'p.

InfraTrust shuningdek, o'rnatilgan komponentlarda eski, foydalanilayotgan zaifliklarni ham topdi, jumladan HP LaserJet Enterprise printerlariga ta'sir qiluvchi Android yadrosi zaifligi va Dell Data Lakehouse dasturiy ta'minotidagi 2020-yilgi jQuery zaifligi.

InfraTrust administratorlarga NetScaler va Ivanti Connect Secure ni yamashni ustuvor qilishni tavsiya qiladi, chunki ushbu masofaviy kirish shlyuzlari korporativ tarmoqlarga kirish eshigi bo'lib xizmat qilishi mumkin. Keyin, u internetga ochiq qurilmalar uchun Fortinet'ning 22-oktyabrdagi FortiOS, FortiManager va FortiAnalyzer xavfsizlik yangilanishlarini tavsiya qiladi.

Hisobot keyinchalik Check Point Security Management Server, Cisco Catalyst SD-WAN Manager, VeloCloud Orchestrator, FortiMail, Cisco Secure Email Gateway, ta'sirlangan BIG-IP APM tizimlari va PAN-OS boshqaruv interfeyslariga e'tibor qaratishni tavsiya qiladi.

Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37 foizi to'xtatiladi

Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.

Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika bo'yicha mudofaa choralarini o'lchaydi.

Hisobotni oling

Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk.

The findings come from Eclypsium's October InfraTrust Pulse, a monthly report tracking security advisories affecting network devices, servers, firmware, chips, and other infrastructure.

Between September 18 and October 14, InfraTrust tracked 133 new security advisories across 18 vendors, covering 2,813 vulnerabilities.

Of those advisories, 37 were rated critical, five had a maximum CVSS score of 10.0, and 58 could be exploited remotely without authentication.

Sixteen newly published advisories included vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog (KEV) as they were actively exploited.

The report also warns that many network appliances, including firewalls, VPN gateways, application delivery controllers, and network-attached storage devices, embed PHP into their management interfaces.

Because vendors compile PHP into appliance firmware, customers commonly cannot install the recent PHP security updates themselves and must instead wait for each vendor to release updated firmware.

InfraTrust therefore recommends that administrators make sure PHP-backed management interfaces are not exposed to the Internet while waiting for PHP2Shell patches.

Critical infrastructure under attack

Some of the most serious vulnerabilities affect systems at the edge of enterprise networks or used to manage other infrastructure.

Threat actors target these devices because they can provide initial access to corporate environments or serve as a springboard for further attacks.

Among the actively exploited flaws highlighted by InfraTrust are:

• Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 were disclosed on September 27 after attacks had already been observed against unpatched appliances. A separate NetScaler flaw, CVE-2026-88779, affecting appliances configured for SAML was also later added to CISA's KEV catalog after exploitation was detected.
• Ivanti Connect Secure: CVE-2026-104935 allows an unauthenticated remote attacker to execute arbitrary commands on vulnerable VPN gateways. Ivanti said it had exploited a limited number of customers when it published the advisory. CISA later added it to the KEV.
• Check Point Security Management Server: CVE-2026-93616 allows an unauthenticated attacker to upload and execute scripts on management and logging systems. Check Point Research observed targeted attacks exploiting the flaw on September 12, targeting Spark customers.
• Cisco Catalyst SD-WAN Manager: CVE-2026-76504 allows an unauthenticated attacker to bypass authentication and gain administrator access to the management API. Cisco became aware of active exploitation in September.
• Arista VeloCloud Orchestrator: CVE-2026-93952 is a maximum-severity flaw affecting the system used to configure SD-WAN Edge devices. Arista says it is being actively exploited and later disclosed a second, separate exploited vulnerability (CVE-2026-114625) in the same product on October 22.
• FortiMail: CVE-2026-104286 is a critical path traversal flaw that allows an unauthenticated attacker to write arbitrary files through the web interface. Fortinet confirmed it was exploited in attacks.
• Cisco Secure Email Gateway: CVE-2026-76519 can allow a malicious email attachment to lead to arbitrary file writes and command execution as root on vulnerable systems. Cisco learned of exploitation in October.
• F5 BIG-IP APM: CVE-2026-94127 is a critical heap overflow that can allow unauthenticated remote code execution on systems configured as OAuth authorization servers. F5 says the vulnerability has been exploited.
• PAN-OS management interface: Palo Alto Networks reported exploitation of CVE-2026-0322 in attacks on firewalls, allowing an authenticated administrator with network access to execute code as root.

php2shell exposes another problem

InfraTrust also warns that the recently disclosed PHP2Shell vulnerabilities expose another weakness in network infrastructure, as many appliances embed PHP directly into their management interfaces.

The two PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution, and the PHP project fixed them on October 21.

While most focus on these vulnerabilities has been on websites and web applications written in PHP, PHP is also used for management interfaces of firewalls, application delivery controllers, VPN appliances, and network-attached storage devices.

For impacted devices, administrators usually cannot update PHP themselves because vendors compile it directly into the appliance firmware. Instead, customers must wait for each vendor to rebuild and release updated firmware or software containing the patched PHP version.

Soon after the disclosure, Palo Alto Networks, F5, NetScaler, Check Point, and QNAP confirmed that some of their products were affected, while they still developed fixes for appliances.

The report also highlights a similar issue in other software components that infrastructure vendors bundle into their products.

CVE-2026-31431, a Linux kernel privilege escalation flaw known as Copy Fail, has now appeared in 29 advisories across eight vendors, up from 19 advisories from six vendors last month.

InfraTrust also found older, exploited vulnerabilities in bundled components, including an Android kernel flaw affecting HP LaserJet Enterprise printers and a 2020 jQuery vulnerability in Dell Data Lakehouse software.

InfraTrust recommends that administrators prioritize patching NetScaler and Ivanti Connect Secure because these remote-access gateways can serve as a doorway into corporate networks. Next, it recommends Fortinet's October 22 FortiOS, FortiManager, and FortiAnalyzer security updates for internet-facing devices.

The report then recommends focusing on Check Point Security Management Server, Cisco Catalyst SD-WAN Manager, VeloCloud Orchestrator, FortiMail, Cisco Secure Email Gateway, affected BIG-IP APM systems, and PAN-OS management interfaces.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report