CVE-2026-35847

This CVE — a shell injection in a DNS management utility's ping function — deserves more scrutiny than its near-zero EPSS score suggests. The gap between CVSS 9.8 and exploitation probability isn't a contradiction; it's a signal about the attack surface, not the severity. The 'local attacker' prerequisite masks something more important: this is infrastructure code running with elevated privileges, managing DNS state that controls network routing for entire systems. A compromise here doesn't require lateral movement — you've already reached the operations center. The real failure isn't one developer's mistake with exec(). It's the pattern: PHP utilities executing shell commands for network diagnostics have been generating injection vulnerabilities since at least 2005, and the pattern persists because the architecture persists. 'CheckUtils.php' — that generic, forgettable name — is a sediment layer of assumptions. Shell_exec('ping '.$target) was written when 'internal only' meant 'permanently exempt from security review,' and that exemption has never been reconsidered despite every version since. Ask yourself two questions. First: if this utility is callable by a web interface or API — and DNS management tools almost always expose diagnostic functions — then the 'local attacker' constraint in this CVE may reflect how it was discovered, not the realistic attack path. Second: if one ping function survived fifteen years of neglect, what other 'internal helpers' in the same codebase carry the same forgotten assumptions? The patch will fix the symptom. The codebase still contains the disease — and the organizational culture that exempted diagnostic code from the same input sanitization expectations as user-facing endpoints.

Reviewed through automated stages and approved by a human before publication.