This edition is all about existing functionality and old flaws that are now being exploited. A Linux kernel bug from May is in the CISA catalogue and turns PHP2Shell webshells into root shells, a Chinese espionage group used a VMware ESX zero-day to mask logs, attackers are targeting Magento web shops and phishers are using MDM platforms to deploy ScreenConnect.
- Linux flaw Fragnesia actively exploited and added to CISA catalogue: kernel bug turns a webshell into a root shell
- Chinese espionage group used VMware ESX zero-day to keep traces out of audit logs, CISA adds flaw to catalogue
- Critical upload flaw in Magento and Adobe Commerce exploited against web shops
- Attackers abuse MDM platforms as a backdoor: Hexnode and Rippling used to put ScreenConnect on endpoints
Linux flaw Fragnesia actively exploited and added to CISA catalogue: kernel bug turns a webshell into a root shell
| Vulnerability | Bug in the ESP-in-TCP path of XFRM in the Linux kernel (Fragnesia): a local attacker can write data into the page cache of read-only files such as /usr/bin/su and thereby gain root. Affected are kernels older than 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174 and 5.15.208, or distribution kernels without the fix |
| CVE number | CVE-2026-46300 |
| CVSS score | 7.8 (according to Security Affairs) |
| Actively exploited | Yes, CISA added the flaw to the KEV catalogue on 28 October 2026, with a deadline of 31 October for US government agencies |
| Patch available | Yes, in stable kernels 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174 and 5.15.208 and in distribution kernels. Temporary mitigation: block the esp4 and esp6 modules |
How has this been exploited?
Fragnesia is a local privilege escalation: the attacker already needs code on the server. According to researcher William Bowling of V12 (via Security Affairs), the flaw has been public since May, including a proof of concept. Now that CISA has added it to its catalogue of known exploited vulnerabilities, there is evidence that attackers are using it. Security Online reports that it is being combined with the PHP2Shell flaws from the 27 October edition of Patchwork: first a webshell via PHP, then root via the kernel.
What could the consequences be?
The modification exists only in memory, not on disk. HOL Guard describes how an attacker can manipulate a file such as /etc/pam.d/su this way without leaving traces on the disk. A reboot or clearing the cache therefore also wipes the evidence. A web server already taken over via PHP2Shell can thus escalate into a fully compromised host.
What should IT administrators do now?
Install a patched kernel or your distribution’s update and then reboot the host. If you cannot patch immediately, block the esp4 and esp6 modules. For hosts suspected of PHP2Shell exploitation, carry out forensic triage of the page cache first before rebooting. Also keep an eye on firewalls and appliances running on a Linux kernel: for those, you will have to wait for firmware from the vendor.
Chinese espionage group used VMware ESX zero-day to keep traces out of audit logs, CISA adds flaw to catalogue
| Vulnerability | Insufficient logging in VMware ESX: an attacker with administrator privileges can carry out certain actions without them being logged. Applies to ESX, vSphere Foundation, Cloud Foundation and Telco Cloud Platform |
| CVE number | CVE-2026-41709 |
| CVSS score | 2.7 |
| Actively exploited | Yes, as a zero-day in early 2026 by Warp Panda (CrowdStrike). CISA added the flaw to the KEV catalogue on 28 October 2026, with a deadline of 11 November |
| Patch available | Yes, since the Broadcom advisory of July 2026: ESXi80U3j-25429389, ESXi-9.0.2.0100-25595025, ESXi-9.1.0.0-25370933 and VCF 5.2.4 |
How has this been exploited?
According to The Hacker News, this is set out in CrowdStrike’s Legal Threat Landscape Report. The Chinese espionage group Warp Panda, also known as Armory Castle (formerly UNC5221), Clay Typhoon and VerdantBamboo, exploited the flaw in early 2026 to reduce the visibility of the audit trail. The group gets in via internet-facing edge devices using zero-days and custom malware, then moves on to VMware vCenter and installs the BRICKSTORM and SharpStorm malware. The group sometimes steals cloud session tokens to access Microsoft 365, and in at least one case it registered a new MFA device to retain access after a password change. Earlier this month, Mandiant also attributed the zero-day in BeyondTrust Remote Support to Warp Panda.
What could the consequences be?
The low score is misleading. The flaw does not give the attacker access; it makes their activity invisible. An MSP managing ESX hosts for customers may, after a breach, find fewer log entries than actions that took place, leaving an incident investigation with too little evidence.
What should IT administrators do now?
Install the fixes from Broadcom’s July advisory (see also the CISA alert), even if your ESX hosts are not connected to the internet. Limit administrator accounts on ESX and vCenter, forward logs to an external log server and check vCenter for unknown MFA devices and unusual sessions.
Critical upload flaw in Magento and Adobe Commerce exploited against web shops
| Vulnerability | Unrestricted upload of files with a dangerous type in Adobe Commerce and Magento Open Source. Affected: Commerce 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, 2.4.4-p18 and earlier (and 2.4.9), Magento Open Source 2.4.8-p5, 2.4.7-p10 and 2.4.6-p15 and earlier, B2B 1.5.3 and earlier releases, Commerce Events 1.6.0 up to and including 1.20.0 |
| CVE number | CVE-2026-48356 |
| CVSS score | 9.6 |
| Actively exploited | Yes, CISA added the flaw to the KEV catalogue on 27 October 2026. At publication in July, Adobe reported no exploitation yet |
| Patch available | Yes, bulletin APSB26-73 of 14 July 2026: the 2026-jul releases (for example 2.4.8-2026-jul for Commerce and Magento Open Source) and Commerce Events 1.21.0 |
How has this been exploited?
According to the Dutch security news site Security.nl, CISA reports attacks on web shops via this flaw, without giving details of the attacks. An unauthenticated attacker can upload dangerous file types to the web server. The Adobe bulletin names user interaction as a precondition and refers to possible privilege escalation.
What could the consequences be?
More than 100,000 web shops run on Magento or Adobe Commerce. Vulnerabilities in this platform are often used to steal customer data and credit card details. For an MSP or hosting provider with Magento customers, this counts double: the patch has been available for months, so a shop that is taken over now has missed a known update.
What should IT administrators do now?
Check for each Magento installation whether the July 2026 patch (APSB26-73) has been installed. Search the upload folders and the webroot for unknown PHP files or other executable uploads. Also check the checkout page for injected scripts.
Attackers abuse MDM platforms as a backdoor: Hexnode and Rippling used to put ScreenConnect on endpoints
| Vulnerability | Abuse of existing functionality: through phishing, victims enrol their device in an attacker-controlled MDM tenant (seen with Hexnode and Rippling), after which the attacker deploys ScreenConnect without authorisation as SYSTEM |
| CVE number | No CVE assigned |
| Actively exploited | Yes, according to Huntress (28 October 2026) |
| Patch available | No, there is no software bug. Mitigation: inventory permitted MDM tenants and RMM instances and treat unexpected enrolments as incidents |
How has this been exploited?
According to Huntress (author Ben Nahorney), it starts with social engineering. In the first case, a user received a phishing email about a request for quotation, with an MSI posing as a DocuSign installer but containing a Hexnode MDM package. ScreenConnect was then installed with an attacker-controlled relay. The MSP removed ScreenConnect, but hours later it was back, because the MDM client had been left in place. In the second case, a receptionist clicked on a fake Teams calendar invitation. The device was enrolled in an attacker-controlled Rippling MDM tenant, the agent ran as SYSTEM and around 35 minutes later ScreenConnect followed.
What could the consequences be?
The MDM client is a trusted management channel, so security software regards it as normal. If you only remove the RMM tool, the attacker simply deploys it again. For MSPs this is particularly sensitive, because your own RMM and MDM look exactly the same to customers.
What should IT administrators do now?
Keep an inventory of permitted MDM products, tenants, agents and RMM instances, and treat an unexpected enrolment as a security incident. An early warning sign in the second case was a new Rippling registry key. Isolate a suspicious endpoint, remove it from the unknown MDM tenant, revoke sessions and tokens, reset credentials and reinstall the device if its integrity cannot be established. Train users to be wary of unexpected meeting, signing and quotation requests.
This article was originally published in Dutch on MSP Business. Read the original →
