Threat reportVulnerabilityTL-2026-4647
Eclypsium InfraTrust Pulse (Oct 2026): Actively Exploited Flaws Across Network Infrastructure Appliances (NetScaler CVE-2026-88771, Ivanti CVE-2026-104935, Check Point CVE-2026-93616, Cisco, Arista VeloCloud, FortiMail, F5 BIG-IP APM, PAN-OS, PHP2Shell, Linux Copy Fail)
Eclypsium InfraTrust Pulse (Oct 2026) (TL-2026-4647), also tracked as Eclypsium InfraTrust Pulse October 2026, is a critical-severity software vulnerability scored CVSS 10, first published 2026-10-28. It has no confirmed attribution, affects Citrix (NetScaler) NetScaler ADC and NetScaler Gateway, references 15 CVEs (CVE-2026-88771, CVE-2026-88772, CVE-2026-88779), maps to 8 MITRE ATT&CK techniques (T1005, T1059.004, T1133), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 15Referenced vulnerabilities
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4647
- Threat ID
- TL-2026-4647
- Also known as
- Eclypsium InfraTrust Pulse October 2026, PHP2Shell, Copy Fail
- Severity
- CRITICAL
- CVSS
- 10
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, telecoms, technology, retail
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Eclypsium InfraTrust Pulse (Oct 2026)
Malware and tooling: PHP
How Eclypsium InfraTrust Pulse (Oct 2026) works
Eclypsium's October 2026 InfraTrust Pulse (Sept 18 - Oct 14, 2026) tracked 133 advisories across 18 vendors and 2,813 vulnerabilities, 16 of them in CISA KEV and 58 remotely exploitable without authentication. It highlights actively exploited flaws in Citrix NetScaler, Ivanti Connect Secure, Check Point, Cisco, Arista VeloCloud, FortiMail, F5 BIG-IP APM, PAN-OS, PHP (PHP2Shell) and the Linux kernel (Copy Fail), and warns that PHP embedded in appliance management interfaces delays patching.
Eclypsium's October 2026 InfraTrust Pulse, covered by BleepingComputer on 2026-10-28, aggregates 133 advisories from 18 vendors covering 2,813 vulnerabilities (37 critical, 5 at CVSS 10.0, 58 remotely exploitable without authentication, 16 in the CISA Known Exploited Vulnerabilities catalog) for the period September 18 - October 14, 2026. This record documents the exploited edge-infrastructure flaws the report prioritises; it is an aggregate/campaign-level record and the sources attribute the exploitation to no single actor.
Remote-access gateways and network management planes. Citrix NetScaler ADC/Gateway CVE-2026-88771 (improper input validation leading to unauthenticated command injection in default configuration, CVSS 9.5, CWE-20) and CVE-2026-88772 (memory overflow, DTLS-dependent, CVSS 9.5, CWE-119) were disclosed 2026-09-27 (CTX697096) but were already exploited; Rapid7 observed the earliest exploitation on 2026-09-20 and documented an observed command-injection payload that tars /flash/nsconfig (ns.conf admin password hashes, SSL private keys, LDAP/RADIUS/TACACS bind credentials) into the publicly served /var/netscaler/gui/vpn/ directory, plus a webshell at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver; two organizations were confirmed compromised. CVE-2026-88779 (SAML-related memory overflow, CVSS 8.7) was exploited after disclosure. Ivanti Connect Secure CVE-2026-104935 (CWE-290 authentication bypass by spoofing enabling unauthenticated command execution; affects 25.1.1.1 and prior, 25.1.2.2 and prior, 22.8R2.4 and prior) was disclosed 2026-10-13 and added to CISA KEV the same day; Volexity reported it was chained with an unpatched privilege-escalation flaw. Check Point Security Management Server CVE-2026-93616 (path traversal / arbitrary file upload, CVSS 9.8, unauthenticated script upload and execution; TCP/19009) was exploited as a zero-day from at least 2026-07-23 against a handful of customers; the report also ties exploitation to Spark customers (a separate Check Point flaw, CVE-2026-85102, KEV 2026-09-23). Cisco Catalyst SD-WAN Manager CVE-2026-76504 (improper URI encoding handling bypassing API authentication, CVSS 9.8) grants unauthenticated admin API access and was exploited as a zero-day. Arista VeloCloud Orchestrator CVE-2026-93952 (CVSS 10.0, CWE-20, only when certificate-based Edge authentication is used; added to KEV 2026-09-22) and a second exploited flaw CVE-2026-114625 are also reported.
Email and application delivery. FortiMail CVE-2026-104286 (path traversal with NULL-byte neutralization flaw, CWE-22/CWE-158, CVSS 9.8, in the Identity-Based Encryption GUI component) allows unauthenticated arbitrary file writes and was exploited as a zero-day (KEV 2026-10-01). Cisco Secure Email Gateway CVE-2026-76519 allows root command execution via a malicious email attachment when the file reputation service is enabled. F5 BIG-IP APM CVE-2026-94127 is a heap overflow in the OAuth UserInfo handler (CVSS 9.8) requiring an APM access policy plus OAuth profile, with a demonstrated chain of callback-pointer corruption, ROP and modification of a service lifecycle script to defeat SELinux. PAN-OS CVE-2026-0322 is a CWE-94 code injection in the management interface giving root code execution to an authenticated admin (KEV 2026-10-14).
Cross-cutting components. PHP2Shell (CVE-2026-109618, a use-after-free in the session upload-progress unserializer on partially initialized request memory; CVE-2026-109619, a stale-state flaw where PHP globals retain references to freed request memory; both CVSS v4.0 9.2) was fixed on 2026-10-21 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Amazon reported first exploitation attempts on 2026-10-17, four days before patches, from anonymization-network IPs. Eclypsium names Palo Alto Networks, F5, NetScaler, Check Point and QNAP as vendors shipping affected embedded PHP, and notes customers cannot update PHP themselves and must wait for vendor firmware. Copy Fail (CVE-2026-31431) is a Linux kernel local privilege escalation in the algif_aead / AF_ALG crypto interface (in-place optimization introduced in 2017; kernels 4.14 through 6.19.12) abused with splice() to corrupt the page cache of setuid binaries such as /usr/bin/su; it was added to CISA KEV on 2026-05-01 and now appears in 29 advisories across 8 vendors (up from 19 across 6).
Defender priorities per Eclypsium: (1) NetScaler and Ivanti Connect Secure; (2) Fortinet FortiOS/FortiManager/FortiAnalyzer October 22 updates; (3) Check Point Management Server, Cisco SD-WAN Manager, VeloCloud Orchestrator, FortiMail, Cisco Secure Email Gateway, BIG-IP APM and PAN-OS management interfaces. Restrict PHP-backed management interfaces from internet exposure while awaiting vendor firmware.
MITRE ATT&CK techniques used in TL-2026-4647
Collection
T1005 Data from Local System; T1560.001 Archive via Utility
Execution
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Persistence
Credential Access
T1552.001 Credentials In Files
Reconnaissance
Affected products and versions in Eclypsium InfraTrust Pulse (Oct 2026)
- Citrix (NetScaler) — NetScaler ADC and NetScaler Gateway
Vulnerable versions: Releases prior to 14.1-73.41; Releases prior to 13.1-64.28
Fixed in: 14.1-73.41 and later; 13.1-64.28 and later; 13.1-FIPS/NDcPP 13.1.37.282 and later - Ivanti — Connect Secure
Vulnerable versions: 25.1.1.1 and prior; 25.1.2.2 and prior; 22.8R2.4 and prior
Fixed in: 25.1.1.2; 25.1.3.0; 25.1.3.1; 22.8R2.5 - Check Point — Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, SmartEvent
Vulnerable versions: R82.20; R82.10; R82; R81.20; R81.10 without hotfix
Fixed in: R82.20 Security Hotfix; R82.10 JHA Take 45; R82 JHA Take 127; R81.20 JHA Take 170; R81.10 JHA Take 192 - Cisco — Catalyst SD-WAN Manager
Vulnerable versions: 26.2; 26.1; 20.18; 20.15; 20.12; 20.9; earlier than 20.9
Fixed in: Fixed releases per Cisco advisory - Cisco — Secure Email Gateway (AsyncOS)
Vulnerable versions: Releases prior to 15.5.5-014 and 16.5.0-780 with file reputation service enabled
Fixed in: 15.5.5-014; 16.5.0-780 - Arista — VeloCloud Orchestrator (on-prem)
Vulnerable versions: 5.2.0 through 5.2.3.16; 6.1.0 through 6.1.3.7; 6.4.0 through 6.4.2.8
Fixed in: See Arista advisory - Fortinet — FortiMail
Vulnerable versions: 8.0.0 through 8.0.1; 7.6.0 through 7.6.6; 7.4.0 through 7.4.8; 7.2.0 through 7.2.9
Fixed in: 7.4.9; 7.6.7; 8.0.2 - F5 — BIG-IP Access Policy Manager (APM)
Vulnerable versions: 21.1.0; 17.5.0 through 17.5.1; 17.1.0 through 17.1.3 with OAuth profile configured
Fixed in: See F5 advisory - Palo Alto Networks — PAN-OS management interface
Vulnerable versions: See vendor advisory
Fixed in: Fixes published 2026-10-14 - PHP Group — PHP
Vulnerable versions: 8.2 before 8.2.35; 8.3 before 8.3.36; 8.4 before 8.4.27; 8.5 before 8.5.12
Fixed in: 8.2.35; 8.3.36; 8.4.27; 8.5.12
Remediation for Eclypsium InfraTrust Pulse (Oct 2026)
Patches
- Check Point R82.20 Security Hotfix; Jumbo Hotfix Accumulators R82.10 Take 45, R82 Take 127, R81.20 Take 170, R81.10 Take 192 (LivePatch does not fix CVE-2026-93616)
- Cisco Secure Email Gateway 15.5.5-014 and 16.5.0-780 for CVE-2026-76519
- PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 (2026-10-21)
- Vendor kernel updates containing upstream fix commit a664bf3d603d for Copy Fail
- Cisco Catalyst SD-WAN Manager fixed releases per Cisco advisory for CVE-2026-76504
Immediate actions
- Patch Citrix NetScaler ADC/Gateway to 14.1-73.41 / 13.1-64.28 or later (13.1-FIPS/NDcPP 13.1.37.282+) and hunt for /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver and archives under /var/netscaler/gui/vpn/
- Apply Ivanti Connect Secure fixes (25.1.1.2, 25.1.3.0/25.1.3.1, 22.8R2.5) and review Volexity's published IOCs
- Remove internet exposure of management planes: Check Point TCP/19009, SD-WAN Manager, VeloCloud Orchestrator, PAN-OS and BIG-IP management interfaces
- Apply Fortinet October 22 updates and FortiMail 7.4.9 / 7.6.7 / 8.0.2
- Rotate NetScaler admin, LDAP/RADIUS/TACACS bind credentials, SSL private keys and SSH host keys on any appliance that may have been exploited
Workarounds
- Copy Fail interim: echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf and rmmod algif_aead
- Restrict access to TCP/19009 on Check Point management servers to trusted IPs
- Cisco states there is no workaround for CVE-2026-76504; upgrade
- Restrict PHP-backed appliance management interfaces from internet exposure until vendor firmware is available
Longer-term hardening
- Inventory embedded PHP runtimes in appliance management interfaces and track vendor firmware release of PHP 8.2.35/8.3.36/8.4.27/8.5.12 fixes
- Place edge appliance management interfaces behind dedicated management networks or VPN-only access
- Monitor CISA KEV and the Eclypsium InfraTrust Pulse for prioritisation of edge infrastructure patching
- Forward appliance logs to a SIEM and alert on unexpected file writes and admin API calls
CVEs associated with Eclypsium InfraTrust Pulse (Oct 2026)
Weaknesses (CWE) in Eclypsium InfraTrust Pulse (Oct 2026)
Timeline of Eclypsium InfraTrust Pulse (Oct 2026)
- Linux kernel Copy Fail (CVE-2026-31431) added to CISA KEV after public disclosure and a 732-byte public exploit
- Earliest observed attacks exploiting Check Point Management Server CVE-2026-93616 against a handful of customers, before any patch existed
- Check Point discloses CVE-2026-85102 affecting Security Gateway/Spark firewalls; exploited against Spark customers and added to CISA KEV on 2026-09-23
- Rapid7 records earliest exploitation of NetScaler CVE-2026-88771 (14:28:43 UTC)
- Arista VeloCloud Orchestrator CVE-2026-93952 (CVSS 10.0) added to CISA KEV; Check Point CVE-2026-93616 and F5 BIG-IP APM CVE-2026-94127 advisories published
- Citrix publishes CTX697096 fixing CVE-2026-88771 and CVE-2026-88772 already under active attack; CVE-2026-88779 exploitation follows
- Cisco discloses exploited Catalyst SD-WAN Manager authentication bypass CVE-2026-76504
- FortiMail zero-day CVE-2026-104286 added to CISA KEV
- Ivanti discloses Connect Secure CVE-2026-104935; CISA adds it to KEV the same day
- Palo Alto Networks publishes PAN-OS CVE-2026-0322 fixes; CISA adds it to KEV; InfraTrust tracking window closes
- Amazon reports first PHP2Shell exploitation attempts, four days before patches
- PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12 fixing PHP2Shell (CVE-2026-109618/109619)
- BleepingComputer reports Eclypsium's October InfraTrust Pulse covering exploited infrastructure flaws
Sources cited for Eclypsium InfraTrust Pulse (Oct 2026)
- InfraTrust report warns of exploited flaws in critical network infrastructure (BleepingComputer)
- Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 (Rapid7)
- Citrix Security Advisory CTX697096
- Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935) (Rapid7)
- Check Point patches exploited Management Server zero-day (SecurityWeek)
- Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (Rapid7)
- New CVSS 10.0 VeloCloud Orchestrator flaw (The Hacker News)
- Critical FortiMail zero-day exploited in the wild (CVE-2026-104286) (Help Net Security)
- Cisco patches actively exploited Secure Email Gateway zero-day (BleepingComputer)
- CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM (Rapid7)
- Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks (BleepingComputer)
- PHP2Shell Exploitation: Two Critical PHP Flaws Explained (Recorded Future)
- Amazon says PHP2Shell exploitation began 4 days before patches (BleepingComputer)
- CVE-2026-31431 Copy Fail (Unit 42)
- CISA warns Copy Fail Linux flaw is already actively exploited (CyberInsider)
Detection coverage for TL-2026-4647
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4647 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.