A Linux kernel bug is being exploited in the wild, and attackers can pair it with the PHP2Shell flaws to plant webshells and run commands as root, according to the U.S. Cybersecurity and Infrastructure Security Agency. CISA added the kernel flaw, CVE-2026-46300, to its Known Exploited Vulnerabilities catalog on October 28, alongside a VMware ESX bug that lets an administrator act without leaving a log trail.
The chaining detail matters. PHP2Shell, the pair of PHP memory-handling flaws tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2 each), has dominated the past fortnight, and CISA listed both as exploited earlier this week. CISA's catalog entry for the kernel bug now says it "can be chained" with those two to get from a web request to root.
A kernel flaw that turns a web bug into root
CVE-2026-46300, Linux kernel (CVSS 7.8). CISA classes it as a missing-initialization flaw (CWE-456). In the agency's description, the kernel fails to preserve a shared-fragment marker when it coalesces socket buffers, which causes ESP (IPsec) input processing to decrypt shared fragments in place and can allow unintended modification of page-cache-backed data. CISA does not say who is exploiting it or against what. Fixes have landed in the stable kernel trees, and CISA links eight upstream commits from its catalog entry. Distribution kernels carry the fix on their own schedules, so check your vendor's advisory.
CISA has also flagged this entry for forensic triage under its new rules, which means federal agencies must check whether they were compromised before the patch went on, not just apply it.
An ESX gap that hides an intruder's tracks
CVE-2026-41709, Broadcom VMware ESX. No CVSS score was available in the NVD data IntelFusions tracks at the time of writing. CISA describes it as an insufficient-logging flaw (CWE-778) that could allow a malicious actor who already has admin access to perform certain operations without being logged. That is not a way in, but for an intruder already on a hypervisor it is a way to work unseen. Broadcom's security advisory carries the affected versions and fix. CISA lists ransomware use as unknown. Hypervisors have long been a favored target for extortion crews, as CrowdStrike's research on hidden ESX shell activity showed in August.
Patch the kernel by October 31, ESX by November 11
Under Binding Operational Directive 26-04, federal civilian agencies must remediate the Linux kernel flaw by October 31 and the ESX flaw by November 11. Everyone else should treat those dates as a guide:
- Prioritize the kernel update on internet-facing Linux hosts that run PHP, and confirm PHP itself is on a release that fixes CVE-2026-109618 and CVE-2026-109619.
- On any PHP host that was exposed before patching, look for unexpected PHP files in web roots and root-owned processes spawned by the web server.
- Apply Broadcom's fix for ESX, and treat ESX hosts where an admin account may have been abused as needing a closer look, since this bug is about what the logs will not show you.
The two entries share a theme. One helps an attacker climb from a web shell to root, the other helps an attacker on a hypervisor stay quiet. Neither is the first step of an intrusion, and both make the later steps much harder to catch.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.