Last updated: October 29, 2026.
CISA added CVE-2026-46300 in the Linux kernel and CVE-2026-41709 in VMware ESX to its Known Exploited Vulnerabilities catalog on October 28, 2026. The Linux entry also describes a chain with the two PHP2Shell vulnerabilities that can lead to PHP webshells and commands running as root. Both additions rest on evidence of active exploitation, CISA says.
Two Entries, Two Different Risks
The dates below are the catalog’s due dates for covered US federal agencies. They are useful priority signals for other teams, but they do not create a general deadline for every business. CISA says its directive applies to Federal Civilian Executive Branch agencies and encourages other organizations to use risk-based remediation.
The difference matters when a team ranks work by severity alone. Broadcom rates the ESX logging issue at CVSS 2.7, while the Linux kernel vulnerability has a CVSS 7.8 score. CISA has now placed both in KEV. A low base score therefore does not mean an exploited weakness can safely fall out of the response queue.
The Linux Entry Connects Kernel Patching With PHP2Shell
CVE-2026-46300 affects how the Linux kernel handles shared fragments in socket buffers. Red Hat describes a local attacker with low privileges changing page-cache data for read-only files. This can let the attacker overwrite privileged binaries and gain root access. Red Hat calls this variant Fragnesia and includes it in its Dirty Frag bulletin.
CISA’s catalog adds a separate operational point. It says this vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. That is a statement about the possible chain in CISA’s entry. The entry does not name a threat group, give a victim count, or say every PHP deployment is exposed to that full chain.
For teams handling the PHP2Shell PHP vulnerabilities, this creates a second patch question. Confirm the host kernel’s status as well as the PHP version. Treat them as separate checks in the same investigation, rather than assuming a PHP update answers the Linux question.
Red Hat’s bulletin lists RHEL 8, 9, and 10 as affected product families and says fixes have been released for all affected products. Products using the RHEL kernel can also be impacted, including RHEL CoreOS. Match the exact system and support stream to the vendor’s errata. A single upstream version number does not describe every supported Linux package.
If a fix cannot be applied at once, Red Hat documents two mitigation routes. Blocking the affected IPsec modules can break IPsec use. Disabling unprivileged user namespaces can affect rootless containers, sandboxed browsers, and Flatpak. Check those dependencies before choosing a temporary measure, and use the vendor’s full procedure.
The VMware Entry Concerns Activity Missing From Logs
CVE-2026-41709 has a different prerequisite and effect. Broadcom says a malicious administrator can perform certain ESX operations without them being logged. This is an insufficient logging vulnerability. It is not the unauthenticated vCenter vulnerability that appears elsewhere in the same multi-issue advisory.
Broadcom’s response matrix for this specific CVE lists ESXi-9.1.0.0-25370933 for the 9.1 branch and ESXi-9.0.2.0100-25595025 for the 9.0 branch. The ESX 8.0 row lists ESXi80U3j-25429389. Its Cloud Foundation 5.x row lists 5.2.4. Telco Cloud Platform users are directed to the separate product guidance linked in that matrix.
Use section 3e of Broadcom’s advisory when checking those builds. The document contains several other CVEs with different fixed releases. Taking a version from the wrong table can give a false answer for this logging issue. Broadcom lists no workaround for CVE-2026-41709.
- Linux KEV entryYesCISA records active exploitation and marks forensic triage Yes.October 28, 2026
- VMware KEV entryYesCISA records active exploitation and marks forensic triage No.October 28, 2026
- Ransomware campaign useUnknownCISA’s campaign-use field is Unknown for both entries.October 28, 2026
Keep Patch Proof and Incident Evidence Together
Our recommended handoff is a short record for each affected system: owner, running build, vendor fix reference, and evidence that the change reached the intended host. For Linux systems in the PHP2Shell response, include the kernel check in the existing incident work. For VMware, record the exact ESX branch and the section 3e fix used.
The vulnerability management process guide explains how to connect that record to remediation work. Our analysis of rising CVE volume covers why counting vulnerabilities alone cannot set that queue. For these two entries, the next concrete step is to compare the deployed build with the relevant vendor guidance and record who owns the remaining action.