The findings come from Eclypsium's October InfraTrust Pulse, a monthly report tracking security advisories affecting network devices, servers, firmware, chips, and other infrastructure. Between September 18 and October 14, InfraTrust tracked 133 new security advisories across 18 vendors, covering 2,813 vulnerabilities.
Of those advisories, 37 were rated critical, five had a maximum CVSS score of 10.0, and 58 could be exploited remotely without authentication. Sixteen newly published advisories included vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog (KEV) as they were actively exploited.
The report also warns that many network appliances, including firewalls, VPN gateways, application delivery controllers, and network-attached storage devices, embed PHP into their management interfaces. Because vendors compile PHP into appliance firmware, customers commonly cannot install the recent PHP security updates themselves and must instead wait for each vendor to release updated firmware.
