CISA Confirms Active Exploitation: PHP2Shell, VMware ESX and Linux Kernel Join the KEV Catalog

CISA confirms active exploitation of PHP2Shell (CVE-2026-109618/109619) and adds VMware ESX, Linux kernel and Adobe Commerce flaws to KEV. What K-12 IT must pat

• CISA added the two PHP 'PHP2Shell' flaws (CVE-2026-109618, CVE-2026-109619, CVSS 9.2, unauthenticated RCE) to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation and giving federal agencies only days to patch.
• The same week's KEV additions include VMware ESX insufficient logging (CVE-2026-41709), Linux kernel CVE-2026-46300, and Adobe Commerce/Magento CVE-2026-48356 paired with Google Brotli CVE-2026-111497 — the latter tied to 'PolyShell' attacks that breached hundreds of stores.
• Impact for K-12 and government: internet-facing PHP (LMS, CMS, portals, appliances) is the top exposure, while the ESX logging gap and the kernel page-cache flaw weaken the audit and integrity evidence you would need during an investigation.

What to do now

1. Inventory every PHP runtime today — including copies bundled inside Moodle/LMS, WordPress, Drupal, library systems, containers and vendor appliances — then patch CVE-2026-109618 and CVE-2026-109619 on internet-facing systems first and reload PHP-FPM/web services so the fix actually takes effect.
2. Remove VMware ESX and vCenter management interfaces from direct internet exposure, restrict them to jump hosts with least-privilege accounts, and forward ESX logs to a tamper-resistant SIEM with alerting on missing or gapped administrative events (CVE-2026-41709).
3. Apply the Linux kernel update for CVE-2026-46300 across servers and appliances and schedule the required reboots; until then, do not rely solely on host file-integrity monitoring for page-cache-backed files.
4. Hunt for exploitation: PHP error and access logs for exploit patterns, new .php files in upload or cache directories, unexpected child processes spawned by php-fpm, new local admin accounts, modified startup items and unusual outbound connections. Isolate and preserve evidence before rebuilding.
5. Rotate credentials, API keys and integration secrets on any host showing compromise indicators, verify backups and test restores, and record KEV remediation dates and any documented exceptions in your vulnerability register.

Related items

• CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch
• Broadcom VMware ESX: Broadcom VMWare ESX Insufficient Logging Vulnerability
• CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
• U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog
• Linux Kernel: Linux Kernel Missing Initialization of a Variable Vulnerability
• Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
• CISA Adds Two Known Exploited Vulnerabilities to Catalog
• CISA Adds Two Known Exploited Vulnerabilities to Catalog