Search — “CVE-2026-76519”

An Eclypsium InfraTrust Pulse report (covering September 18 to October 14) lists actively exploited vulnerabilities across network appliances and warns that PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) affect PHP embedded in appliance management interfaces. Because vendors compile PHP into firmware, customers must wait for vendor firmware updates. InfraTrust recommends keeping PHP-backed management interfaces off the Internet until patches arrive; the sources do not describe confirmed PHP2Shell exploitation in the wild.

Cisco warned that CVE-2026-76519 (CVSS 9.8) in Secure Email Gateway is being exploited; an unauthenticated sender using a crafted email attachment can write files to the appliance OS and potentially run commands as root. Only gateways with File Reputation enabled on a mail policy and Content Scanner Tools older than 25.3.0.5525 are vulnerable, and Cisco has contacted managed Secure Email Cloud customers showing possible compromise indicators. Hunters should run the published 'grep "System Security" system_logs' check, review firewall logs for uploads to external IPs or downloads from malicious ones, and verify the scanner version with contentscannerstatus.