InfraTrust report tracks 133 advisories and 2,813 vulnerabilities

Eclypsium’s October InfraTrust Pulse tracked 133 new security advisories across 18 vendors between September 18 and October 14, covering 2,813 vulnerabilities. The report said 37 advisories were rated critical, five vulnerabilities had a maximum CVSS score of 10.0, and 58 could be exploited remotely without authentication. Sixteen advisories included flaws listed in CISA’s Known Exploited Vulnerabilities catalog as actively exploited.

The report warns that PHP flaws dubbed “PHP2Shell” put management interfaces on firewalls, VPN appliances, application delivery controllers and network-attached storage devices at risk. CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution. The PHP project fixed the flaws on October 21, but affected appliance users generally must wait for vendors to release updated firmware or software because PHP is built into those products.

Palo Alto Networks, F5, NetScaler, Check Point and QNAP confirmed that some products were affected while they developed fixes. InfraTrust also highlighted CVE-2026-31431, the Linux kernel privilege escalation flaw known as Copy Fail: it appeared in 29 advisories across eight vendors, up from 19 advisories across six vendors the previous month.

The report recommends prioritizing patches for NetScaler and Ivanti Connect Secure, followed by October 22 updates for Fortinet’s FortiOS, FortiManager and FortiAnalyzer on internet-facing devices. It also calls attention to several other infrastructure products, including Cisco Catalyst SD-WAN Manager, VeloCloud Orchestrator and PAN-OS management interfaces.