Attackers are exploiting security flaws in VMware ESX and in older Linux kernels to cover their tracks or gain more privileges after breaking in. The US agency CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming the attacks.
VMware ESX: admin actions without a log entry
The ESX flaw (CVE-2026-41709) has been public since late July and sits in the virtualization software's logging. Admins can carry out certain operations without them being recorded. Broadcom rates this as low risk with a CVSS score of 2.7 and has stuck with that so far, even though the flaw is now being actively abused. Given the attacks, that rating looks far too mild.
CrowdStrike shows what this looks like in practice in its new threat report on the legal sector. According to the report, the China-linked group "Warp Panda" went after US companies in the legal field and planted various malware in their vCenter environments. It used the logging flaw as a zero-day to avoid leaving traces.
Linux kernel: Fragnesia after php2shell
Since Tuesday it has been known that the PHP flaws around "php2shell" are being exploited successfully. According to the security firm Dream, attackers also linked to China took over 25 firewall servers in the US, Japan, Taiwan and South Korea in what appears to be an AI-assisted campaign. Dream does not name the affected product. Palo Alto Networks, however, has been warning since Wednesday about active attacks on the php2shell flaws in its firewall operating system PAN-OS and has hotfixes available.
Once inside, the attackers escalated privileges on the target systems through the Linux kernel flaw known as "Fragnesia" (CVE-2026-46300, CVSS 7.8, rated high). Microsoft warned about it back in mid-May, and patched kernels have been available for months.
What you should do
Check whether any servers in your environment are still running old software, and catch up on updates quickly. Broadcom has been shipping patches for VMware ESX since late July, and the PHP team closed the php2shell flaws last week. This combination shows nicely why an old kernel is not a minor detail: one flaw gets attackers in, the next one makes them root.