Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

CISA flags Linux and VMware flaws as actively exploited

Part of the CVE-2026-46300 story · since 14 May

Developinglatest 2 hours ago9 articles6 outlets
14 May · The Hacker News first8 Aug6 Sep5 OctNowThis article9th of 9
  • Thu 14 May, 08:00 UTC. The Hacker News, first report. Fragnesia Linux LPE Flaw CVE-2026-46300 Lets Attackers Gain Root. Cites a CVE in CISA KEV.
  • Thu 14 May, 13:11 UTC. Infosecurity, its first report on the story. New Fragnesia Flaw Hands Linux Local Users Root Access. Cites a CVE in CISA KEV.
  • Thu 14 May, 13:50 UTC. SecurityWeek, its first report on the story. Linux Kernel Flaw Fragnesia Lets Local Users Gain Root Access. Cites a CVE in CISA KEV.
  • Thu 14 May, 18:41 UTC. Security Affairs, its first report on the story. Fragnesia Flaw CVE-2026-46300 Allows Local Users to Gain Root. Cites a CVE in CISA KEV.
  • Tue 19 May, 09:50 UTC. SecurityWeek. DirtyDecrypt kernel flaw PoC released, raising privilege fears. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 13:00 UTC. SecurityWeek. China Linked Hackers Exploit PHP Flaws to Root Firewalls. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 17:00 UTC. The Hacker News. Dream links PHP2Shell attacks to 25 rooted servers. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 20:01 UTC. CISA, its first report on the story. CISA adds exploited Linux kernel flaw CVE-2026-46300 to KEV. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 00:00 UTC. SecurityOnline, its first report on the story. CISA flags Linux and VMware flaws as actively exploited. Cites a CVE in CISA KEV. This article, 9th of 9.

On 28 October 2026, CISA added a Linux kernel flaw, CVE-2026-46300, to its Known Exploited Vulnerabilities catalog and noted it is being chained with PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619). The same advisory also listed a VMware ESX bug, CVE-2026-41709, as exploited. CISA states both flaws are actively being exploited, with the kernel chain enabling attackers to implant PHP webshells and gain root access.

Patches exist for both issues, and federal agencies are required to apply fixes by 31 October 2026 for the Linux kernel and by 11 November 2026 for ESXi, VMware’s hypervisor, according to the agency’s guidance.

The advisory provides a concise impact and technical context. For the Linux kernel, CVE-2026-46300 scores 7.8 (CWE-787) and is described as enabling unintended modification of page-cache-backed data when the kernel merges network buffers, which, when combined with a PHP2Shell foothold, can escalate to root. For the VMware ESX flaw, CVE-2026-41709 scores 2.7 (CWE-778) and is characterised as allowing a malicious administrator to perform certain operations without their actions being logged.

Affected versions include the Linux kernel releases 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1, and ESXi 9.1, 9.0 and 8.0 prior to the fixes in VMSA-2026-0006, with related Cloud Foundation and Telco Cloud Platform releases also implicated. Patches are available and should be applied via standard security channels.

How the story developed

All 9 articles
Developinglatest 2 hours ago9 articles6 outlets

9 articles from 6 outlets since 14 May. Picked up again on 28 Oct after 23 weeks quiet. This was the 9th report, 168 days after the first.

Now14 May1516171819202127 OctFirst reportThe Hacker News · 14 May, 08:00This article9th of 9 · day 168
  • Thu 14 May, 08:00 UTC. The Hacker News, first report. Fragnesia Linux LPE Flaw CVE-2026-46300 Lets Attackers Gain Root. Cites a CVE in CISA KEV.
  • Thu 14 May, 13:11 UTC. Infosecurity, its first report on the story. New Fragnesia Flaw Hands Linux Local Users Root Access. Cites a CVE in CISA KEV.
  • Thu 14 May, 13:50 UTC. SecurityWeek, its first report on the story. Linux Kernel Flaw Fragnesia Lets Local Users Gain Root Access. Cites a CVE in CISA KEV.
  • Thu 14 May, 18:41 UTC. Security Affairs, its first report on the story. Fragnesia Flaw CVE-2026-46300 Allows Local Users to Gain Root. Cites a CVE in CISA KEV.
  • Tue 19 May, 09:50 UTC. SecurityWeek. DirtyDecrypt kernel flaw PoC released, raising privilege fears. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 13:00 UTC. SecurityWeek. China Linked Hackers Exploit PHP Flaws to Root Firewalls. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 17:00 UTC. The Hacker News. Dream links PHP2Shell attacks to 25 rooted servers. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 20:01 UTC. CISA, its first report on the story. CISA adds exploited Linux kernel flaw CVE-2026-46300 to KEV. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 00:00 UTC. SecurityOnline, its first report on the story. CISA flags Linux and VMware flaws as actively exploited. Cites a CVE in CISA KEV. This article, 9th of 9.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Thu 14 MayDay 04
    1. Fragnesia Linux LPE Flaw CVE-2026-46300 Lets Attackers Gain Root08:00 · The Hacker News · First report · Exploited CVE · Known exploited CVE
    2. New Fragnesia Flaw Hands Linux Local Users Root Access13:11 · Infosecurity · Known exploited CVE
    3. Linux Kernel Flaw Fragnesia Lets Local Users Gain Root Access13:50 · SecurityWeek · Known exploited CVE
    4. Fragnesia Flaw CVE-2026-46300 Allows Local Users to Gain Root18:41 · Security Affairs · Known exploited CVE

  2. Quiet for 5 days

    Tue 19 MayDay 51
    1. DirtyDecrypt kernel flaw PoC released, raising privilege fears09:50 · SecurityWeek · Picked up again · Known exploited CVE

  3. Quiet for 23 weeks

    Wed 28 OctDay 1673
    1. China Linked Hackers Exploit PHP Flaws to Root Firewalls13:00 · SecurityWeek · Picked up again · Known exploited CVE
    2. Dream links PHP2Shell attacks to 25 rooted servers17:00 · The Hacker News · Known exploited CVE
    3. CISA adds exploited Linux kernel flaw CVE-2026-46300 to KEV20:01 · CISA · official · CISA alert · Known exploited CVE
  4. Thu 29 OctDay 1681
    1. CISA flags Linux and VMware flaws as actively exploited00:00 · SecurityOnline · Known exploited CVE · This article, 9th of 9

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in