CISA adds a Linux kernel flaw chained with PHP2Shell and a VMware ESX logging flaw to KEV

CISA adds a Linux kernel flaw chained with PHP2Shell and a VMware ESX logging flaw to KEV

28 October 2026: The US Cybersecurity and Infrastructure Security Agency added two vulnerabilities to its Known Exploited Vulnerabilities catalog on 28 October. One is a Linux kernel flaw that CISA says can be chained with the PHP2Shell bugs to plant webshells and run commands as root; federal agencies have only three days, to 31 October, to deal with it. The other is a low-severity VMware ESX flaw that lets a malicious administrator act without being logged, due by 11 November.

Not yet independently verified. CISA's alert page refused our request; the dates come from CISA's KEV data feed and the NVD record. We could not read the Linux kernel commits CISA lists, so fixed kernel versions are not given here, and neither CISA nor Broadcom says who is exploiting either flaw. We will update this when it can be confirmed, and remove this note.

Linux kernel CVE-2026-46300

CISA describes CVE-2026-46300 as a missing initialisation in the kernel's networking code: a shared-fragment marker is not kept when socket buffers are merged, so ESP (IPsec) input processing decrypts shared fragments in place and alters data backed by the page cache. In CISA's words, it "can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root". Those two are the PHP2Shell vulnerabilities, already in the catalog.

The short due date and the forensic triage flag CISA set on the entry point to active use. CISA's notes link eight stable kernel commits; we could not read them, so the fixed kernel versions should be taken from your distribution's advisory. Servers running PHP applications on Linux with IPsec in use are the case to check first.

VMware ESX CVE-2026-41709

CVE-2026-41709 is an insufficient logging flaw in VMware ESX: a malicious administrator can perform certain operations without them being logged. Broadcom rates it 2.7, low, in VMSA-2026-0006, the advisory first published on 29 July that also fixed critical vCenter and ESX flaws. Its presence in KEV means CISA has evidence it is being used; by its nature it helps someone who already holds administrator access avoid leaving a record. Fixed releases listed by Broadcom are ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 and ESXi80U3j-25429389, with VMware Cloud Foundation 5.x fixed in 5.2.4. There is no workaround. The Canadian Centre for Cyber Security updated its own advisory on 28 October to note the KEV listing.

What to take from it

The two entries share a lesson: low or local scores do not mean low priority once a flaw is part of a working chain. The kernel flaw is useful to attackers because of what it unlocks after PHP2Shell, and the ESX flaw because it covers the tracks of someone already inside. Federal agencies are bound by the due dates under Binding Operational Directive 26-04; other organisations can use the same dates as a sensible deadline. Hosts that run ESX 8.0 and have not yet taken the builds from the July advisory should treat the vCenter and ESX fixes in VMSA-2026-0006 as overdue.

Sources

• CISA: Known Exploited Vulnerabilities catalog data feed, version 2026.10.28, 28 October 2026
• Broadcom: VMSA-2026-0006, VMware ESX, vCenter, Workstation and Fusion updates, 19 August 2026
• Canadian Centre for Cyber Security: AV26-763, VMware security advisory, update 2 (28 October 2026), 28 October 2026
• NVD: CVE-2026-41709, 28 October 2026