InfraTrust Report Warns of Actively Exploited PHP Flaws in Network Infrastructure

InfraTrust's latest security report, covered by BleepingComputer, warns that threat actors are actively exploiting a set of PHP vulnerabilities collectively referred to as "PHP2Shell." These flaws target the web-based management interfaces of critical network infrastructure devices, including firewalls, virtual private network (VPN) appliances, and application delivery controllers. The report indicates that the vulnerabilities have been observed in real-world exploitation, putting global network infrastructure at risk.

The PHP2Shell flaws specifically affect the web management interfaces of affected appliances. Successful exploitation could allow an unauthenticated or low-privileged attacker to gain unauthorized access to the device's administrative interface. This access could facilitate further malicious activities, including configuration changes, credential theft, and lateral movement within the compromised network.

InfraTrust's report does not attribute the exploitation to a specific threat actor group but notes that the vulnerabilities affect a wide range of network equipment from multiple vendors. The advisory emphasizes that the web management interfaces, often exposed to the internet for administrative convenience, represent a significant attack surface. Organizations are urged to treat these flaws as high priority for patching and mitigation.

Vendor advisories and firmware updates are expected to address the PHP2Shell vulnerabilities. Until patches are applied, security teams are advised to restrict access to management interfaces, employ strong authentication mechanisms, and monitor for anomalous device behavior.