On October 26 we covered PHP's two critical remote code execution flaws (php2shell). The same day, the US Cybersecurity and Infrastructure Security Agency (CISA) added both, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. On October 28 CISA added a Linux kernel flaw, CVE-2026-46300, and its entry says plainly that it can be chained with the two PHP flaws to implant PHP webshells and run commands as root. In other words, attackers use PHP to get the web server's privileges and the kernel bug to escalate to root.

The Kernel Bug: Fixed Since May, but Many Servers Never Rebooted

  • Ubuntu calls CVE-2026-46300 Fragnesia. When the kernel coalesces socket buffers it can lose the "shared fragment" marker, so IPsec ESP (ESP-in-TCP) decrypts in place over data backed by the page cache. NVD scores it CVSS 3.1 7.8 (local attack); Ubuntu rates it high priority as a "trivial local privilege escalation" that may also allow a container escape.
  • It has been public since May 23, and fixed kernels have been available for months: Ubuntu's generic kernels are fixed from 5.15.0-181.191 on 22.04, 6.8.0-124.124 on 24.04 and 7.0.0-22.22 on 26.04 (the same kernels that fixed May's Dirty Frag flaws); Debian 12 is fixed from 6.1.174-1 (DSA-6306-1) and Debian 13 from 6.12.90-1 (DSA-6295-1). Cloud-specific kernels such as linux-aws carry different version numbers, so check Ubuntu's CVE page for yours.
  • The catch: a kernel update only takes effect after a reboot. Ubuntu's default unattended upgrades install the new kernel within 24 hours, but Ubuntu states clearly that a reboot is still required. A server that hasn't rebooted in months may well still be running a vulnerable kernel.

What to Do Now

  • PHP: check php -v, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution's fixed package), then restart PHP-FPM or Apache. CISA's advice is that anyone still on PHP 8.1 or older unsupported versions, or unable to update right away, should take those systems offline; a WAF provides only partial protection.
  • Kernel: compare uname -r with the versions above, run sudo apt update && sudo apt upgrade, then sudo reboot. If you truly cannot change kernels yet, Ubuntu's stopgap is to block the esp4 and esp6 modules (lines such as install esp4 /bin/false in /etc/modprobe.d/), but that breaks IPsec VPNs such as strongSwan.
  • Check whether you were already hit: CISA marked both PHP flaws and the kernel flaw as requiring forensic triage. What CISA singles out is PHP worker processes launching shells or downloading tools; while you are at it, look for recently added .php files in your web directories (upload folders above all), unfamiliar cron jobs and unknown SSH keys.

Why Both Must Be Fixed Together

Patch PHP but not the kernel, and the next web flaw can still turn the web server's privileges into root; patch the kernel but not PHP, and the site itself stays wide open. Only with both fixed and the server rebooted is this attack chain cut. If you suspect a compromise, work through investigating and re-securing a compromised VPS; for baseline hardening (firewall, key-only login) see ufw firewall and SSH key login; for September's batch of exploited kernel flaws see this report; and before reinstalling, make sure your backups themselves are clean.