Plan
active
InfraTrust report: PHP2Shell attacks hit firewalls, VPNs, ADC management UIs
- Engineer — Plan: Active exploitation of PHP-based management interfaces on firewalls, VPNs, and ADCs is claimed, but no KEV listing, EPSS, or public PoC is present to drive immediate action. Audit whether management interfaces are exposed externally and schedule patching of affected appliances once vendor advisories are confirmed.
- SOC/IR — Learn: PHP2Shell as a web-shell delivery technique against network appliance management planes is worth filing as a TTP, but this report provides no IOCs, ATT&CK mappings, or specific indicators to hunt on — insufficient signal for detection work today.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.