CISA KEV catalog addition October 28, 2026; Palo Alto Networks advisory update and The Hacker News report October 29, 2026
PHP2Shell Meets Fragnesia: CISA Gives the Linux Kernel Flaw an October 31 Deadline as Palo Alto Confirms Exploitation
CISA added the Linux kernel flaw known as Fragnesia, CVE-2026-46300 (CVSS 7.8), to its Known Exploited Vulnerabilities catalog on October 28 and set a remediation due date of October 31, 2026 for federal civilian agencies, bringing the catalog to version 2026.10.28 with 1,762 entries. CISA describes the flaw, a missing initialization of a variable in the kernel socket buffer code (CWE-456), in direct chain terms: it can be chained with the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. That chain is no longer hypothetical. Israeli firm Dream reported a suspected China-nexus actor using it on October 23 and 24 to root 25 servers across the United States, Japan, Taiwan, and South Korea, including three systems in a United States government-affiliated environment, followed by attacks against Active Directory with confirmed credential extraction and directory enumeration. On Wednesday, Palo Alto Networks warned that active exploitation of PHP2Shell has been observed against its management interfaces exposed to the internet, that no special configuration is required to be affected, and that the risk is highest on PAN-OS when management access is allowed from external addresses; the issue affects the management web interface, including the HTTPS user interface and XML API service, and the dataplane only where a management profile is attached. The PHP fixes shipped upstream on October 21 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and the kernel flaw, disclosed on May 13, is fixed in the stable releases listed in the CVE record, including 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, and 6.18.33 and later in each series. Fragnesia alone needs local access with low privileges, which is exactly what a PHP2Shell webshell provides.
Executives
Two deadlines now sit inside one attack chain: PHP2Shell was due today, October 29, and the kernel step that turns it into full control is due October 31. Every device in the reported campaign was found because its management interface faced the internet. Ask one question this week: which of our firewalls, servers, and appliances can be managed from the public internet, and why.
CIO / CISO
Treat PHP and kernel patching as a single work item, not two queues: PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, plus a fixed kernel, plus a reboot so the new kernel actually loads. Where a PAN-OS hotfix is still listed with an October 29 or 30 arrival, apply Palo Alto Networks mitigations in the meantime, starting with removing external management access. On any exposed and unpatched host from last week, hunt for new PHP files in web folders, new SSH keys, and outbound SSH sessions, and rotate LDAP and Active Directory service account credentials reachable from those hosts.
Engineers
A kernel update that has not been rebooted into is not a fix: verify the running kernel with uname -r after the restart. If a reboot has to wait and the machine does not use IPsec, the interim step recorded in distribution guidance is to block the esp4, esp6, and rxrpc modules from loading, then remove that block once the fixed kernel is live. Ask appliance vendors directly whether their firmware ships PHP and which build fixes it, because the firewall build in the Dream report ran an end-of-life PHP version.
Everyone (non-IT)
Nothing here asks individual users to act. If your workplace restarts servers or takes a firewall offline briefly this week, this chain is why: the window between a flaw being published and attackers automating it is now measured in days.