Attackers are actively exploiting vulnerabilities in network devices, with PHP flaws known as 'PHP2Shell' targeting web management interfaces of firewalls, VPNs, and other appliances.
The vulnerability or weakness
The PHP2Shell vulnerabilities, including CVE-2026-88771 and CVE-2026-88772, allow attackers to exploit web management interfaces of critical network infrastructure without the need for authentication.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-104935 | 8.6 | HIGH | Yes, added 2026-10-13 | 2026-10-16 |
| CVE-2026-88771 | 9.5 | CRITICAL | Yes, added 2026-09-27 | 2026-09-30 |
| CVE-2026-88772 | 9.5 | CRITICAL | Yes, added 2026-09-27 | 2026-09-30 |
| CVE-2026-88779 | 8.7 | HIGH | Yes, added 2026-10-04 | 2026-10-07 |
| CVE-2026-93616 | 9.8 | CRITICAL | Yes, added 2026-09-22 | 2026-09-25 |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations face significant operational risks, as attackers can gain unauthorized access to their network devices, potentially leading to data breaches and system compromises.
Industries affected
This issue affects a wide range of industries, including IT, telecommunications, and any sector relying on network devices for critical operations.
Users affected
Customers using firewalls, VPNs, and application delivery controllers are at risk, as they may not be able to update PHP themselves, leaving them vulnerable until vendors release updated firmware.
