Linux kernel flaw joins PHP exploit chain in firewall attacks

CISA added Linux kernel vulnerability CVE-2026-46300 to its KEV catalogue on 28 October 2026, listing active exploitation and setting 31 October 2026 as the remediation deadline.CISA Dream researchers said attackers chained the flaw with PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 to gain root access on 25 firewall servers, including a US government-affiliated system.SecurityOnline The researchers described access to an internal management server and attempts to exfiltrate SAML signing keys; they attributed the activity with medium-to-high confidence to a Chinese-nexus operator but did not name a definitive group.SecurityOnline

AnalysisCISA’s catalogue confirms exploitation of the Linux flaw, while Dream’s account describes its use in a chain with the PHP vulnerabilities.CISASecurityOnline

SignalWire’s FreeSWITCH team reported in-the-wild exploitation of CVE-2026-116779, which can let a crafted SIP MESSAGE execute operating-system commands with the server’s privileges.SecurityOnline The flaw affects FreeSWITCH 1.11.2 and earlier and is fixed in 1.11.3, the team said.SecurityOnline Two other disclosed flaws, CVE-2026-116785 and CVE-2026-116790, affect versions 1.11.1 and earlier and are fixed in 1.11.2; the team had not reported those flaws exploited in the wild.SecurityOnline

Proofpoint Threat Research observed exploitation of CVE-2026-112353 in GFI KerioConnect Webmail to steal credentials and mailbox contents, SecurityOnline reported.SecurityOnline The attack uses a crafted SVG email attachment to run JavaScript in a victim’s Webmail session, according to the report.SecurityOnline All versions before KerioConnect 10.0.8 Patch 2 are affected, and GFI released that fix on 28 November 2025; the vulnerability was not listed in CISA’s KEV catalogue in the report.SecurityOnline