PHP2Shell exploited in the wild, CISA chains it with a Linux kernel flaw

A week after emergency PHP patches for CVE-2026-109618 and CVE-2026-109619, exploitation was found to have begun about four days before the fixes shipped, with CISA confirming attacks on 26 October. TU Delft tracked over 50,000 exploitation requests from 600+ IPs in 70 countries, and on 28 October CISA added Linux kernel flaw CVE-2026-46300 (Fragnesia), which can be chained with the PHP bugs to gain root.

• Exploitation began about 4 days before the PHP patches were released
• TU Delft tracked 50,000+ requests from 600+ IPs across 70 countries
• CVE-2026-46300 affects kernels built before 13 May 2026
• CISA added 8 KEV entries this week, 4 of them server software