Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as “PHP2Shell” put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk.

The findings come from Eclypsium’s October InfraTrust Pulse, a monthly report tracking security advisories affecting network devices, servers, firmware, chips, and other infrastructure.

Between September 18 and October 14, InfraTrust tracked 133 new security advisories across 18 vendors, covering 2,813 vulnerabilities.