🧰 Cortex Xpanse

The items that name it 4

• Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)
  advisory2026-10-29

  Identifies exposed devices on the public internet and escalates findings to defenders; its telemetry found over 22.6 million potentially vulnerable instances; alerting depends on the PHP Attack Surface Rule being enabled

• Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
  writeup2026-10-14

  Identifies exposed devices and applications on the public internet and escalates findings to defenders.

• Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
  advisory2026-09-30

  Identifies exposed NetScaler ADC and Gateway devices on the internet; found 50,277 potentially vulnerable instances as of Sept. 27, 2026; alerting via the InsecureCitrixApplicationDeliveryController Attack Surface Rule

• Socket: Next.js Moves to Scheduled Security Releases
  article2026-07-16

  Palo Alto tool used to count more than 968,000 exposed React and Next.js instances vulnerable to React2Shell.