CISA Adds Linux Kernel Flaw Chained With PHP2Shell and VMware ESX Bug to KEV
Do Son 
TL;DR
On October 28, CISA added a Linux kernel vulnerability and a VMware ESX flaw to its Known Exploited Vulnerabilities catalog. The kernel bug, CVE-2026-46300, is being chained with the PHP2Shell flaws. According to CISA, the chain lets attackers “implant PHP webshells and run commands as root.”
CISA confirms active exploitation of both flaws. Federal agencies must fix the Linux kernel vulnerability by October 31, and the ESX bug by November 11. Patches already exist for both.
- Product: Linux, VMware Cloud Foundation +1
- Vulnerabilities: 4 flaws (CVE-2026-46300, CVE-2026-41709, CVE-2026-109618, CVE-2026-109619)
- Highest severity: 9.2 (Critical · CVSSv4)
- Worst impact: RCE via OOM corruption
- Status: 4 exploited; patches available
- Exploit Intel (PatchThis): 4 of 4 confirmed
- Action: Update to 3599e6b3cc1ada96883d496a50a210d3afbb6987, 2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c, 9d3e5fd19fe1063bf607219e8562fbd567b8e8d5, 78bf6b6bb19541d19fbda6242e7cfe2c682763c0 (+20) now
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status | PoC |
|---|---|---|---|---|---|
| CVE-2026-109618 | 9.2 | RCE via OOM corruption | 8.2.35, 8.3.36, 8.4.27 (+1) | Exploited | Available (Nuclei) |
| CVE-2026-109619 | 9.2 | RCE via stale global state | 8.2.35, 8.3.36, 8.4.27 (+1) | Exploited | — |
| CVE-2026-46300 | 7.8 | CWE-787 | 3599e6b3cc1ada96883d496a50a210d3afbb6987, 2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c, 9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 (+13) | Exploited | Available (Metasploit) |
| CVE-2026-41709 | 2.7 | CWE-778 | 5.2.4, ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 (+1) | Exploited | — |
Why It Matters
The kernel deadline gives agencies just three days, compared with two weeks for the ESX bug. That signals real urgency. Moreover, PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is already under broad attack. This chain turns a web server foothold into full root control.
How the Attack Works
CVE-2026-46300: Linux kernel
This flaw scores 7.8 on CVSS. When the kernel merges network buffers, it loses a “shared fragment” marker. As a result, IPsec ESP processing can “decrypt in place over page-cache backed frags,” per the kernel fix. CISA says this allows “unintended modification of page-cache-backed data.” Attackers pair it with a PHP2Shell foothold to gain root.
CVE-2026-41709: VMware ESX
This bug scores only 2.7. However, it lets “a malicious administrator” perform “certain operations without them being logged.” In other words, attackers who already hold admin access can hide their tracks.
Affected Versions
- Linux kernel: fixed in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1
- VMware ESX: 9.1, 9.0 and 8.0 before the fixes in VMSA-2026-0006, plus related Cloud Foundation and Telco Cloud Platform releases
Patch and Mitigation
Fix the Linux kernel vulnerability through your distribution’s security channel, and patch PHP to close the entry point. For ESX, apply the ESXi 9.1.0.0, 9.0.2.0100 or 8.0 U3j builds.
CISA lists ransomware use as “Unknown” for both.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
