CISA Warns of Active Exploitation of Three Linux Kernel Flaws; WordPress Click2Shell PoC Adds Urgency

CISA warns of active exploitation of three Linux kernel flaws; WordPress Click2Shell PoC lets attackers execute PHP. Patch and isolate now.

CISA is warning that attackers are actively exploiting three Linux kernel vulnerabilities, one rated critical; specific CVE IDs were not provided in source summaries.
Affected: Linux servers, VMs, containers, network appliances, and other systems across K-12 and government networks; WordPress sites are also at risk from a new Core CSRF flaw dubbed Click2Shell.
Impact: denial of service, memory disclosure, memory modification, and potential PHP execution on WordPress servers; unpatched internet-facing systems are the highest priority.

What to do now

Inventory every Linux kernel version across servers, VMs, containers, appliances, and cloud instances; map each to its distribution or vendor advisory and flag internet-facing or mission-critical systems first.
Apply vendor kernel security updates immediately and schedule reboots or live patching in an approved change window; if patching is delayed, isolate vulnerable hosts and restrict access with firewall rules and segmentation.
Hunt for exploitation signs: unexpected child processes, privilege escalation, persistence mechanisms, kernel panics, out-of-memory events, unexpected reboots, and unusual outbound connections; preserve logs.
For WordPress, update Core as soon as a fixed release is available, restrict wp-admin by IP or VPN, enable WAF rules for CSRF and suspicious POSTs, disable the built-in file editor, require MFA, and scan for webshells.
Verify offline backups are current and restorable, rotate credentials if compromise is suspected, and report suspected incidents to CISA and your district or state security contacts.