Pulse October 2026

October 28, 2026

By Paul Asadoorian & Chase Snyder

php2shell puts PHP flaws only the vendor can fix inside network edge appliances, and ten advisories fix flaws attackers were already exploiting

By the numbers

This is the October 2026 edition of InfraTrust Pulse, our monthly rundown of the security advisories that matter for the infrastructure running everything, such as network devices, servers, chips, firmware, and baseboard management controllers (BMCs). The September edition closed on September 17, so this one picks up on September 18 and runs through October 14, 2026. We also cover three urgent items published after October 14 that are not in our counts: php2shell, Fortinet’s October 22 hardening release, and a second exploited flaw in Arista’s VeloCloud Orchestrator.

In this report’s window, we tracked 133 new security advisories across 18 vendors, covering 2,813 distinct Common Vulnerabilities and Exposures (CVE) identifiers. Thirty-seven are rated Critical, and five score a perfect 10.0. Fifty-eight are remotely exploitable with no authentication, something we always highlight for defenders to prioritize. Sixteen newly published advisories include CVEs on the CISA KEV. 96 advisories were revised during the window without being newly published.

InfraTrust Pulse October 2026: vendor advisories by severity

At a glance: the exploited and Critical items in this edition, plus three urgent items outside our counts.

Update, October 26, 2026: EDKII network boot vulnerability

On October 22, TianoCore disclosed CVE-2026-97631 in the Preboot Execution Environment (PXE) driver of EDK II, the open-source reference code that most UEFI firmware is built on. Its advisory, GHSA-99cj-7hg9-mp4m, rates the flaw Critical, CVSS 9.5. While a server or PC is network booting over IPv4 or IPv6, an unauthenticated attacker who can get an oversized ICMP error message to it, from anywhere a packet can reach it, can hang the boot. An attacker who also knows the exact firmware build can run code in the firmware before the operating system loads and before Secure Boot or measured boot has checked any of it. TianoCore merged a fix into the EDK II reference code on October 15. As of October 26, we have not seen a firmware update for it from any server, PC or firmware vendor. Until your vendor ships one, turn off PXE boot on every system that doesn’t need it. Where you do rely on it, keep PXE provisioning on an isolated network segment, and have the routers and firewalls in front of that segment drop ICMP error messages that arrive from outside it. 

October 2026 Analysis

If your network team only gets one thing done this week, it should be confirming that no firewall, application delivery controller (ADC), or virtual private network (VPN) management interface is reachable from the internet. That step reduces exposure to php2shell, which leads this edition, and to the exploited flaws in the Check Point Management Server, Cisco Catalyst SD-WAN Manager, the VeloCloud Orchestrator, and the PAN-OS management interface. Fortinet customers have one more item. On October 22, Fortinet shipped FortiOS, FortiManager, and FortiAnalyzer updates that fix Critical and High severity flaws it will not describe until November 10, and it asks customers to install them as a priority, starting with internet-facing devices.

Most of the CVEs vendors fixed this month were in code they did not write. php2shell is a pair of flaws in PHP that the PHP project fixed the day they were disclosed, and most appliance owners are still waiting because each vendor compiled its own copy of PHP into its firmware and must rebuild and ship that firmware itself. Several advisories in this window roll up patches for bundled supply chain components, including the six covered below that carry KEV-listed component flaws, and almost all of those components are open source. 

F5 publishes a verdict for every upstream flaw it evaluates, and deserves credit for it. In this window, F5 published 97 notices about third-party components, including 21 for the Linux kernel, seven for GnuTLS, six each for Vim and Python, and OpenSSL, and five each for Apache Tomcat, and in 81 of them it concluded that no F5 product was affected. A vendor that publishes “not vulnerable” verdicts is being helpful by making it easier to answer the questions such as “Is my F5 device vulnerable to this?” (even though it makes the vendor look busier in a tracker like this one).

The same inherited flaws keep cropping up through different vendors. CVE-2026-31431, the Linux kernel privilege escalation known as Copy Fail, which CISA added to KEV on May 1, now appears in 29 advisories across eight vendors in our data, up from 19 across six last month. Older KEV-listed flaws arrive the same way. HP’s LaserJet Enterprise printers carry an Android kernel race condition that has been on the KEV list since September 2025, and Dell’s Data Lakehouse carries a jQuery flaw from 2020.

php2shell reaches appliance management consoles

On October 21, 2026, the PHP project released fixes for two remote code execution flaws in PHP’s core, the scripting language behind a large share of the web. The flaws are CVE-2026-109618 and CVE-2026-109619, both rated Critical, CVSS 9.2, and fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Researchers at Calif found them alongside OpenAI and Wiz and published the write-up as php2shell. Most coverage focuses on websites because the researchers confirmed unauthenticated code execution against applications such as WordPress, Drupal, and Nextcloud. PHP also runs the web management consoles of many firewalls, ADCs, and network-attached storage devices, and owners cannot install the fix on those devices. Within a day of disclosure, Palo Alto Networks, F5, NetScaler, Check Point, and QNAP confirmed that some of their products are affected, and none had a fixed release to offer. Fixes have started to arrive since then. As of October 24, QNAP has fixed QTS, QuTS hero, and QuTScloud, Check Point has hotfixes for R81.20, R82 and R82.10, and HPE’s ClearPass 6.14.1 and 6.11.16 releases partially fix the flaws. Citrix plans NetScaler fixes for October 27, and Palo Alto Networks lists target dates of October 26 through 30 for fixed PAN-OS releases.

It’s notable for several reasons, primarily because the required work must start before fixes exist. Network and appliance administrators should make sure no PHP-backed management interface is reachable from the internet. Vulnerability management should track each vendor’s advisory for fixed versions, and incident responders should know that the first exploitation attempt on record predates the disclosure by four days.

For your own environment, the useful question is what is inside each appliance. If you cannot yet list which of your appliances serve their management interface with PHP, and on which PHP branch, that is a high priority. Vendor management and procurement can ask each appliance vendor for a software bill of materials, or at least a list of the major open-source components and versions in each firmware release, and vulnerability management can track the components that keep recurring across every vendor rather than one advisory at a time.

Where each vendor stands, as of October 24, 2026

Harden Your AI Infrastructure Now

The most serious artificial intelligence (AI) infrastructure flaws in this window are not in the graphics processing units (GPUs). They lie in the software that provisions servers and connects nodes. None of the NVIDIA items below is known to be exploited or is on the KEV list, so this is planned patching for the teams that run AI clusters rather than an emergency.

NVIDIA Infrastructure Controller, hard-coded credentials rated Critical, 9.8

NVIDIA bulletin 5879 (September 22) covers 14 CVEs in NVIDIA Infrastructure Controller, NVIDIA’s open-source bare-metal lifecycle manager for AI data centers, the software that provisions and isolates the servers in a GPU cluster. The top flaw, CVE-2026-65113, is a hard-coded credential that an unauthenticated attacker can use over the network, rated Critical, CVSS 9.8. Four others require only adjacent network access and no credentials, including a missing-authentication flaw rated High (8.3; CVE-2026-65114) and an authentication flaw rated High (8.2; CVE-2026-65121). Separately, an authenticated SQL injection, CVE-2026-65128, reaches code execution and is rated High (8.8.

BlueField and ConnectX firmware, and the GPU driver

NVIDIA bulletin 5847 (September 29) fixes CVE-2025-33207 in BlueField data processing unit and ConnectX network adapter firmware, where a user with access to a virtual function can send a malicious command to the firmware and cause a denial of service that reaches beyond that function.

The September GPU driver bulletin, NVIDIA bulletin 5861, includes 114 CVEs, all local, with the highest scoring 7.8 on CVSS. It covers the data-center driver branches (R580, R595, R610, and R615 on Linux) and the virtual GPU Manager for XenServer, vSphere, Red Hat Enterprise Linux with Kernel-based Virtual Machine, and Ubuntu, the component that keeps tenants apart on a shared GPU, which accounts for 17 of the CVEs. 

This InfraTrust issue also flags advisories with CVEs relevant to NVIDIA GB200 systems when they were published, and most fall outside this window. They show the same fix reaching GB200 owners at different times. NVIDIA’s January GPU driver bulletin (NVIDIA-5747, January 28) reappeared in Lenovo’s LEN-210045 on February 10 and HP’s HPSBHF04099 on March 9, and the May bulletin (NVIDIA-5821, May 19) reached Lenovo’s LEN-216341 on June 9. CVE-2025-10263, an Arm CPU translation bypass on InfraTrust’s GB200 list (the GB200’s Grace CPU is Arm-based), appears in AMD’s AMD-SB-8021 and HPE’s HPESBHF05057 (both June 9), F5’s K000163625 (October 9), and six Dell roll-ups that bundle the Linux kernel fix. Teams running GB200 systems should track NVIDIA’s bulletins and their server vendor’s advisories separately.

Teams running AI clusters should upgrade the Infrastructure Controller first, since it is reachable over the network without credentials.

What to patch first

Sixteen advisories published in this window include a CVE on CISA’s KEV list. Ten of them fix a vendor’s own flaw that attackers were already exploiting. The other six carry an older KEV-listed flaw in a bundled component. Several of these were exploited before a fix existed, so network and appliance administrators should patch while incident response hunts for earlier compromise, rather than treating the upgrade as the end of the job. For the Ivanti and Arista items, the vendor’s own tooling or fixes do not yet cover everything.

Fortinet’s October 22 hardening release

Fortinet’s chief information security officer, Carl Windsor, wrote on October 21 that Fortinet would ship a coordinated set of security updates for FortiOS, FortiManager and FortiAnalyzer on October 22, following new FortiMail and FortiAuthenticator releases, and his post is direct about why. The releases include Critical and High severity fixes for flaws found through Fortinet’s own testing with frontier artificial intelligence (AI) models. The public advisories, with the CVEs and details, will not appear until Fortinet’s next Patch Tuesday on November 10. Fortinet expects attackers to use similar AI tools to reverse-engineer patches and build working exploits within hours or days. Fortinet has asked its customers to treat the upgrade as a priority change rather than routine maintenance, starting with internet-facing devices. This is outside our counts because no advisory exists yet. Holding back the details is meant to slow attackers who use AI to turn patches into exploits. The announcement is public, though, so attackers know to start looking at the same time defenders start patching. We expect more vendors to try this approach.

Citrix NetScaler, unauthenticated code execution in the default configuration

Citrix’s CTX697096 bulletin of September 27 covers eight CVEs in NetScaler ADC and NetScaler Gateway, and attackers exploited two of them (CVE-2026-88771 and CVE-2026-88772) before the bulletin was published. Citrix says exploits have been observed against unmitigated appliances, and CISA added both to KEV the same day. 

A second bulletin, CTX697174 on October 4, covers CVE-2026-88779, a denial-of-service rated High, 8.7, on appliances configured as a SAML service provider or identity provider. CISA added that to KEV on October 4. A third bulletin, CTX697191 on October 8, covers CVE-2026-107406, rated Critical, 9.5, also in the SAML code.

Ivanti Connect Secure, exploited on fully patched gateways

Ivanti’s advisory of October 13 covers CVE-2026-104935, rated High, CVSS 8.6, which lets a remote, unauthenticated attacker run arbitrary commands on the Connect Secure VPN gateway. Ivanti says it was exploited against a limited number of customers at disclosure, and CISA added it to KEV the same day.

Check Point Management Server, exploited two months before the fix

sk1000171 covers CVE-2026-93616, rated Critical, CVSS 9.8, a directory traversal and file upload flaw that lets an unauthenticated attacker upload and execute scripts on the Security Management Server, Multi-Domain Security Management, Log Server, Multi-Domain Log Server and SmartEvent. The Security Management Server stores firewall policies. Check Point Research says it saw a handful of targeted attacks on July 23, 2026, about two months before the fix, and CISA added it to KEV on September 22.

Cisco Catalyst SD-WAN Manager, unauthenticated administrator access

cisco-sa-sdwan-webauth-xr8beuuU (September 30) covers CVE-2026-76504, rated Critical, CVSS 9.8, in the manager for Cisco’s software-defined wide area network (SD-WAN). A crafted HTTP request that encodes characters in its path gets past an authentication rule on an application programming interface (API) endpoint and gives an attacker administrator access to the API in any configuration. Cisco learned of active exploitation in September, and CISA added it to the KEV list as the ninth Cisco SD-WAN entry in 2026. 

Arista VeloCloud Orchestrator, a perfect 10.0 under active exploitation

Arista Security Advisory 0183 (September 22) covers CVE-2026-93952 in the on-premises VeloCloud Orchestrator, the system that configures every SD-WAN Edge in a deployment. It scores a perfect 10.0, Critical, on CVSS 3.1 (9.5 on CVSS 4.0). The orchestrator is exposed if certificate-based authentication from Edge to Orchestrator is configured, and an attacker needs only the public part of an Edge authentication certificate and network access to the web interface, with no tenant or operator credentials. Arista says it was discovered externally and is being actively exploited, and CISA added it to KEV the same day. Arista disclosed a second, separate exploited flaw in the same product on October 22, covered below, with the exploited items outside our counts.

FortiMail, four days with only a workaround

FG-IR-26-175 (October 1) covers CVE-2026-104286, a path traversal in the FortiMail web interface that lets an unauthenticated attacker write arbitrary files with crafted requests, rated Critical, CVSS 9.8 (Fortinet displays a temporal score of 8.8). Fortinet says it was exploited in the wild, CISA added it to KEV on October 1, and for about four days the advisory listed the fixes as “upcoming” and offered only a workaround. 

Cisco Secure Email Gateway, the second exploited flaw in a month

cisco-sa-esa-afw-zqYJkjxp (October 14) covers CVE-2026-76519, rated Critical, CVSS 9.8. An unauthenticated attacker sends an email with a crafted attachment through the gateway and gets an arbitrary file write and command execution as root when the File Reputation service is enabled on a mail policy and the Content Scanner Tools component is older than 25.3.0.5525. Cisco learned of exploitation in October, and CISA added it to KEV the day Cisco published. 

F5 BIG-IP APM, when it acts as an OAuth authorization server

K000162605 covers CVE-2026-94127, a heap overflow in BIG-IP APM that gives an unauthenticated attacker remote code execution, rated Critical, CVSS 9.8 (9.3 on CVSS 4.0). F5 says it has been exploited, and CISA added it to KEV on September 22. The exposure is narrow. Only APM configured as an OAuth authorization server, with an access policy and an OAuth profile on a virtual server, is affected, and APM used as an OAuth client or resource server is not.

PAN-OS management interface, root for anyone with administrator credentials

Palo Alto Networks’ CVE-2026-0322 advisory (October 14) covers a code injection flaw in the PAN-OS management interface that lets an authenticated administrator with network access run code as root on PA-Series and VM-Series firewalls and Panorama, rated High, 8.6 on CVSS 4.0. Palo Alto reports very limited exploitation, and CISA added it to KEV the day it was published. 

Critical, not yet known to be exploited

These are not on the KEV list, but each is reachable without credentials or sits on a system that administers others, and several are management consoles like many of the exploited items above.

  • Cisco License On-Prem (formerly Smart Software Manager On-Prem). The October hardening release is rated a perfect 10.0, Critical, and the separate License On-Prem advisory includes CVE-2026-20328, which lets an unauthenticated attacker reset the password of any account, including the administrator’s, rated Critical, CVSS 9.1. 
  • SonicWall SMA 1000. SNWLID-2026-0017 (October 6) fixes CVE-2026-102255, an unauthenticated server-side request forgery in the Work Place interface rated a perfect 10.0. It is the third unauthenticated SSRF in SMA 1000 this year, after the ones covered in the July and September editions. The same advisory fixes a command injection that needs administrator credentials (CVE-2026-102256, 7.8) and a Zip Slip flaw in the management console (CVE-2026-102257, 7.2). Fixed builds are 12.4.3-03670 and 12.5.0-03082. SonicWall reported no exploitation when it published, and Defused Cyber and Previdian reported exploitation attempts against decoy appliances starting October 8, without confirmed compromises.
  • HPE Aruba Networking ClearPass Policy Manager, the network access control policy engine. HPESBNW05158 fixes 28 CVEs, topped by an authenticated SQL injection rated Critical, 9.9 (CVE-2026-79798). Other Critical flaws include unauthenticated deserialization leading to code execution, unauthenticated Structured Query Language (SQL) injection, and an unauthenticated bypass to administrator. ClearPass is also affected by php2shell. HPE’s bulletin HPESBNW05171 says 6.14.1 and 6.11.16 only partially fix those flaws and that full fixes are still in development, so plan for a second ClearPass upgrade.
  • HPE Aruba Networking Analytics and Location Engine and AOS-Switch. HPESBNW05137 fixes default hard-coded credentials that give unauthenticated access to the application and its operating system, rated Critical, 9.8 (fixed in 5.1.0.0). HPESBNW05156 fixes an authentication bypass in the AOS-Switch web management interface and unauthenticated buffer overflows, all rated Critical, 9.8, on the 2530 through 5400R switch families (fixed in 16.11.0032). 
  • Cisco Application Policy Infrastructure Controller (APIC). The APIC hardening release includes three unauthenticated CVEs, each rated Critical (9.8), affecting the controller that manages an Application Centric Infrastructure (ACI) data center fabric. 
  • Cisco Nexus 3000 and 9000 switches in standalone NX-OS mode. Cisco’s October 7 bundle included three remote code execution advisories, each rated Critical (9.8), that give an unauthenticated attacker root access to the switch. They are cisco-sa-napi-rce-r2shwu2j (CVE-2026-76471) in the NX-API interface, cisco-sa-moam-rce-uBTzYV7 (CVE-2026-76465) in Multiprotocol Label Switching (MPLS) operations, administration and maintenance (OAM), and cisco-sa-ngoam-rce-LWKQ4BU (CVE-2026-76485, CVE-2026-76486 and CVE-2026-76501) in the next-generation version of that feature, which Cisco calls NGOAM. These are the switches Cisco’s own reference design uses to connect the GPU servers in an AI cluster.
  • Arista CloudVision on-premises. Arista Security Advisory 0190 includes CVE-2026-102159, a missing-authentication flaw in CloudVision-CUE, Arista’s on-premises Wi-Fi manager, rated Critical, 9.8 on CVSS 3.1. It was one of 14 Arista advisories published on October 6 for CloudVision Portal, CloudVision-CUE, and Arista Wi-Fi access points. The cloud-hosted CloudVision services and EOS switches are not affected.
  • Fortinet FortiSandbox. FG-IR-26-185 is an authentication bypass in the FortiSandbox web interface that lets an unauthenticated attacker execute unauthorized code or commands, with a base score of Critical, 9.8 (Fortinet displays 9.6). 
  • Ivanti Xtraction and Neurons Patch for Intune. Both are rated Critical (9.9), and both require a logged-in attacker. The Xtraction flaw lets that attacker capture the connector credentials Xtraction uses for Ivanti Endpoint Manager Mobile, fixed in 2026.4. Neurons Patch for Intune is a cloud service Ivanti fixed on September 16, and Ivanti recommends rotating the client secret on the Microsoft Entra ID app registration it uses.

Exploited, but not in our numbers

These are being exploited, but they fall outside our counts, either because the advisory was published before or after the window, or because CISA listed it after the window closed.

Arista VeloCloud Orchestrator, a second exploited flaw

Arista Security Advisory 0199 (October 22) covers CVE-2026-114625, a flaw in the on-premises VeloCloud Orchestrator that lets an attacker with network access to the web interface and any valid portal login, down to the Enterprise Read Only role, reach privileged internal functions and affect the host. It is rated Critical, 9.9 on CVSS 3.1 (9.4 on CVSS 4.0). Arista found it, says it is actively exploited, and says no configuration prevents the exposure. It is a different flaw from the advisory 0183 issue covered in What to patch first, so orchestrators patched for that one still need VCO 5.2.3.18, 6.1.3.10, or 6.4.2.12. Hosted VeloCloud deployments were already patched.

Fortinet FortiOS, an April advisory that CISA KEV listed on October 16

FG-IR-26-122, published April 14, covers CVE-2025-61624, a path traversal in the command-line interface of FortiOS, FortiProxy, FortiPAM and FortiSwitchManager that lets an authenticated administrator write or delete arbitrary files. Fortinet rates it Medium, 6.0, and the advisory now carries a “Known Exploited: Yes” flag without a logged revision. 

FortiBleed, a credential campaign rather than a vulnerability

The Federal Bureau of Investigation (FBI) and the United States Secret Service published a joint advisory on October 6 about FortiBleed, a global campaign that logs into internet-facing FortiGate firewalls and VPN gateways with reused or leaked credentials, cracks weak legacy password hashes, creates its own administrator accounts, and sells the access to ransomware affiliates. The advisory cites 86,644 compromised devices in 194 countries, a figure it attributes to SOCRadar, and Fortinet has said it is not a new Fortinet vulnerability.

Group-IB and NyxLab reported on October 21 on a campaign they call Stray Cat, which used known flaws, including CVE-2025-64446 in FortiWeb, brute-forced FortiGate logins to break into Fortinet FortiGate and Palo Alto Networks GlobalProtect gateways through known flaws, including CVE-2025-64446 in FortiWeb firewalls and Palo Alto Networks GlobalProtect gateways, then stole credentials and tried to reach domain administrator access inside victims’ networks. Group-IB assesses with moderate confidence that it is associated with FortiBleed, and says the evidence does not establish that the same operators ran both.

Revised, Not New

Ninety-six advisories were revised during this window without being newly published. Ten vendors account for all of them, led by Dell at 29, Lenovo at 27, F5 at 13 and Cisco at 12, followed by HP at 5 and Check Point, Fortinet, Intel, NVIDIA and Palo Alto at 2 each. By original publication date, 75 are from 2026, 10 from 2025, nine from 2024, one from 2023, and one from 2016. The 2016 entry is F5’s K13167034 for the OpenSSL flaw CVE-2016-2183, revised on September 29, almost exactly ten years after it was first published. The revisions below are the ones that you may want to re-read:

FAQ

A monthly rundown of the security advisories that matter for the infrastructure running everything. Network gear, servers, chips, firmware, and BMCs. New edition every month.

NetScaler and Ivanti Connect Secure first, since they are remote-access gateways by design, along with Fortinet’s October 22 FortiOS, FortiManager, and FortiAnalyzer releases, starting with internet-facing devices. Then the Check Point Management Server, which holds your firewall policy. Then Cisco Catalyst SD-WAN Manager, the VeloCloud Orchestrator, and FortiMail. Then Cisco Secure Email Gateway, F5 BIG-IP APM if it acts as an OAuth authorization server, and the PAN-OS management interface.

Not that anyone has published. Amazon saw the first attempt against its honeypots on October 17. Palo Alto Networks, Cisco, Fortinet and QNAP say they are not aware of attacks on their products. Restrict the management interfaces anyway.

Because the vendor compiled PHP into the firmware. Only the vendor can ship the fix. Some appliances run a PHP branch that the PHP project no longer patches.

No. Check for compromise first, because Citrix says an update does not remove what an attacker left behind. On the 14.1 branch, the fixed build is the one Remko Weijnen found still running end-of-life PHP behind its management interface.

Because CISA added its CVE to the exploited list on October 16. Unit 42 reports attackers used it to get root on FortiGate firewalls and load PEERSTITCH, a memory-resident implant. It is rated Medium, 6.0.

Sources