Priority alerts and briefings from Radar, by email.
Checking availability…
Security advisory
Linux: patch the kernel used by the PHP2Shell escalation chain
CISA added CVE-2026-46300 to KEV on October 28 and identifies a chain with the two original PHP2Shell CVEs that can reach root. Apply the distributor fix and verify the kernel actually running on each affected host.
Who should check: Teams operating Linux hosts, including hosts serving affected PHP applications.
Recommended actionFix available
Apply the kernel fix for your distribution, preserve evidence where compromise is suspected and activate the corrected kernel using the distributor procedure. Verify the running kernel after remediation.
The kernel can lose a shared-fragment marker while combining socket buffers. Later ESP processing may overwrite data backed by the page cache. Red Hat describes local privilege escalation from a low-privilege account. This is not a standalone remote unauthenticated entry point.
CISA added CVE-2026-46300 to KEV on October 28, 2026. Its entry identifies a chain with PHP CVE-2026-109618 and CVE-2026-109619 that can implant webshells and run commands as root. This does not establish the same chain for CVE-2026-115560 or prove compromise of every Linux or PHP installation.
Use the distributor advisory to select the correction, including backports. Installing a new package does not demonstrate that the running kernel has changed.
The supplier timeline in the CVE record dates public disclosure to May 13; the Linux CNA record was published May 23. October 28 is the KEV addition date, not the disclosure date or the beginning of attacks. CISA federal remediation dates and triage requirements are not universal customer deadlines.
CISA lists this kernel CVE in KEV. It requires local access on its own; CISA identifies a chain with PHP CVE-2026-109618 and CVE-2026-109619. Neither the chain nor KEV establishes compromise of an individual host.
What does this mean for AI environments?
Oktsec recommends including Linux hosts that run agents or hold their credentials in the inventory; the kernel flaw is not specific to AI software.
Added advisory coverage with product-specific response steps and dated exploitation evidence.
Response actions
Plan your response
0 of 5 actions recorded as done
Use this checklist to decide whether the advisory affects your systems, record what your team does and share the result. Radar does not scan or verify your environment.
Changes save automatically in this browser. They are not synced with your team or sent to Oktsec.
1. Check whether this applies
Read the advisory and its sources, then record your decision below. If you are unsure, choose “Needs verification”.
Applicability decisionNot assessed
2. Track the response
Name the system and person or team handling the work. Update each action as you go; add a ticket reference or notes to explain what was checked.
1
Inventory affected host kernels
Identify the distribution, kernel package and running kernel on each host. Include container hosts; updating a container image alone does not update its host kernel.
Add evidence or notesUse references only. Do not store credentials or confidential data here.
2
Preserve evidence before disruptive changes
Where compromise is suspected, preserve evidence with incident-response support. Investigate the initial access path as well as escalation; a kernel update does not remove an existing webshell.
Add evidence or notesUse references only. Do not store credentials or confidential data here.
3
Apply the distributor correction
Use the security update for the installed distribution and branch. Follow its reboot or supported live-patch procedure; upstream version numbers alone do not account for distribution backports.
Add evidence or notesUse references only. Do not store credentials or confidential data here.
4
Verify the kernel in use
Record the running kernel and the distributor advisory or supported live-patch verification result. An installed package or scheduled reboot is not proof that the fix is active.
Add evidence or notesUse references only. Do not store credentials or confidential data here.
5
Review PHP separately
Check CVE-2026-109618 and CVE-2026-109619 where PHP runs on the host. Keep their remediation separate from the kernel fix; CISA does not extend this chain claim to other PHP CVEs.
Add evidence or notesUse references only. Do not store credentials or confidential data here.
3. Share the plan
Download a Markdown file with your decision, action status, notes and source links. Share it with your team or attach it to a ticket.
Compare the running version and configuration with the vendor guidance.
Product
Affected
Fixed release / action
Confirm distribution backports with the vendor. A matching product alone does not establish exposure.
Access requiredApplication or configuration dependent
TRACEABLE EVIDENCE
Evidence & sources
Checked Oct 28, 2026 UTC
Why this priority
CISA lists this kernel CVE in KEV. It requires local access on its own; CISA identifies a chain with PHP CVE-2026-109618 and CVE-2026-109619. Neither the chain nor KEV establishes compromise of an individual host.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA’s federal deadlines and requirements are shown for context. They are not a universal deadline for private organizations or businesses in Latin America. The date added is the catalog inclusion date, not the first attack date.
Priority applies to the parent advisory, not separately to every product or CVE. Each row shows only the evidence attributed to that CVE. Missing attack evidence does not mean a vulnerability is safe to ignore. Your environment has not been scanned.
Sources
Technical facts come from these sources. Response priorities and recommended actions are Oktsec’s analysis.