If you run your own Linux server or VMware host, two flaws CISA listed on October 28 need your attention

Linux: Fragnesia (CVE-2026-46300)

Fragnesia is a privilege escalation in the Linux kernel’s IPsec code. A user or program already on the machine, even one with very limited rights, can write into the in-memory copy of files it’s only allowed to read, and use that to become root. It was disclosed on May 13, 2026, and fixed kernels shipped that month.

“Already on the machine” sounds reassuring, but on a web server it usually isn’t. A hole in the website, like the PHP2Shell flaws CISA listed on October 26, gives an attacker a foothold as the web server’s low-privilege user. Fragnesia turns that foothold into control of the whole machine, and published analyses (linked below) say attackers are chaining the two. Updating PHP closes the door; updating the kernel stops a foothold from becoming a takeover. You need both.

• Upstream kernels: fixed in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1.
• Red Hat Enterprise Linux: RHSA-2026:19568, RHSA-2026:19569 and RHSA-2026:19666.
• Ubuntu, Debian and Amazon Linux shipped fixed kernels in May.
• Not affected: the standard kernels on RHEL 6 and 7 and on Ubuntu 16.04, 18.04 and 20.04. Those releases are past standard support, which is its own problem.

VMware ESX (CVE-2026-41709)

Broadcom’s advisory VMSA-2026-0006 describes an insufficient-logging flaw: someone with administrator access to an ESX host can carry out some actions without them being recorded in the audit log. Broadcom rates it low, because the attacker already needs admin rights. How it was used changes the picture. CrowdStrike’s 2026 report on threats to the legal sector says Warp Panda, a China-linked group, exploited it as a zero-day in early 2026 to hide its activity.

• ESXi 9.1: ESXi-9.1.0.0-25370933.
• ESXi 9.0: ESXi-9.0.2.0100-25595025.
• ESXi 8.0: ESXi80U3j-25429389.
• VMware Cloud Foundation: 5.2.4. Telco Cloud Platform: Broadcom KB 449886.
• Broadcom lists no workaround.

What to do

1. Check the kernelRun “uname -r” on each server and compare it with your distribution’s fixed kernel. A server that hasn’t loaded a new kernel since May almost certainly needs the update, plus a reboot or a live patch to put it in use.
2. Look before you rebootFragnesia’s changes live in memory, so a reboot wipes the evidence along with the problem. If the server runs PHP and wasn’t updated for PHP2Shell, check first for unfamiliar files in the web folders, new user accounts and new scheduled tasks.
3. If you can’t patch right awayBlocking the kernel’s esp4 and esp6 modules closes the path Fragnesia uses, but it also breaks IPsec VPNs on that machine. Only do it on servers that don’t use one.
4. Patch your ESX hostsApply the VMSA-2026-0006 build for your version. Because the flaw hides admin activity, also review who has admin rights on the hosts and on vCenter, and change those passwords if anything looks off.

We build and run private servers for offices that want their own hardware, and keeping the operating system underneath current is part of that job. If you think one of your servers was already entered, our incident response team can help.

Sources

• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 28, 2026)
• Rescana: Linux kernel Fragnesia CVE-2026-46300, chained with PHP2Shell
• heise: Attacks exploit Linux and VMware ESX vulnerabilities
• Security Affairs: CISA adds Linux kernel and Broadcom VMware ESX flaws to its catalog
• Broadcom VMSA-2026-0006
• NVD: CVE-2026-46300
• NVD: CVE-2026-41709