{"id":168,"date":"2026-10-29T07:44:14","date_gmt":"2026-10-29T06:44:14","guid":{"rendered":"https:\/\/mspbusiness.com\/en\/it-news\/patchwork-thursday-29-october\/"},"modified":"2026-11-02T16:15:49","modified_gmt":"2026-11-02T15:15:49","slug":"patchwork-thursday-29-october","status":"publish","type":"post","link":"https:\/\/mspbusiness.com\/en\/security\/patchwork-thursday-29-october\/","title":{"rendered":"Patchwork &#8211; Thursday 29 October"},"content":{"rendered":"<p id=\"top\"><strong>This edition is all about existing functionality and old flaws that are now being exploited. A Linux kernel bug from May is in the CISA catalogue and turns PHP2Shell webshells into root shells, a Chinese espionage group used a VMware ESX zero-day to mask logs, attackers are targeting Magento web shops and phishers are using MDM platforms to deploy ScreenConnect.<\/strong><\/p>\n<ul>\n<li><a href=\"#fragnesia\">Linux flaw Fragnesia actively exploited and added to CISA catalogue: kernel bug turns a webshell into a root shell<\/a><\/li>\n<li><a href=\"#esx\">Chinese espionage group used VMware ESX zero-day to keep traces out of audit logs, CISA adds flaw to catalogue<\/a><\/li>\n<li><a href=\"#magento\">Critical upload flaw in Magento and Adobe Commerce exploited against web shops<\/a><\/li>\n<li><a href=\"#mdm\">Attackers abuse MDM platforms as a backdoor: Hexnode and Rippling used to put ScreenConnect on endpoints<\/a><\/li>\n<\/ul>\n<h4 id=\"fragnesia\">Linux flaw Fragnesia actively exploited and added to CISA catalogue: kernel bug turns a webshell into a root shell<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Bug in the ESP-in-TCP path of XFRM in the Linux kernel (Fragnesia): a local attacker can write data into the page cache of read-only files such as \/usr\/bin\/su and thereby gain root. Affected are kernels older than 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174 and 5.15.208, or distribution kernels without the fix<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-46300<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">7.8 (according to Security Affairs)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, CISA added the flaw to the KEV catalogue on 28 October 2026, with a deadline of 31 October for US government agencies<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, in stable kernels 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174 and 5.15.208 and in distribution kernels. Temporary mitigation: block the esp4 and esp6 modules<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>Fragnesia is a local privilege escalation: the attacker already needs code on the server. According to researcher William Bowling of V12 (via <a href=\"https:\/\/securityaffairs.com\/192145\/security\/linux-kernel-bug-fragnesia-allows-local-root-access-attacks.html\" target=\"_blank\" rel=\"noopener\">Security Affairs<\/a>), the flaw has been public since May, including a proof of concept. Now that CISA has added it to its catalogue of <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/10\/28\/cisa-adds-two-known-exploited-vulnerabilities-catalog\" target=\"_blank\" rel=\"noopener\">known exploited vulnerabilities<\/a>, there is evidence that attackers are using it. <a href=\"https:\/\/securityonline.info\/cisa-kev-linux-kernel-php2shell-vmware-esx\/\" target=\"_blank\" rel=\"noopener\">Security Online<\/a> reports that it is being combined with the PHP2Shell flaws from the <a href=\"https:\/\/mspbusiness.com\/security-en-privacy\/patchwork-dinsdag-27-oktober\/\" target=\"_blank\" rel=\"noopener\">27 October edition of Patchwork<\/a>: first a webshell via PHP, then root via the kernel.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>The modification exists only in memory, not on disk. <a href=\"https:\/\/hol.org\/guard\/security\/campaigns\/cve-2026-46300-fragnesia-linux-kernel-cisa-kev-root\" target=\"_blank\" rel=\"noopener\">HOL Guard<\/a> describes how an attacker can manipulate a file such as \/etc\/pam.d\/su this way without leaving traces on the disk. A reboot or clearing the cache therefore also wipes the evidence. A web server already taken over via PHP2Shell can thus escalate into a fully compromised host.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Install a patched kernel or your distribution&#8217;s update and then reboot the host. If you cannot patch immediately, block the esp4 and esp6 modules. For hosts suspected of PHP2Shell exploitation, carry out forensic triage of the page cache first before rebooting. Also keep an eye on firewalls and appliances running on a Linux kernel: for those, you will have to wait for firmware from the vendor.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"esx\">Chinese espionage group used VMware ESX zero-day to keep traces out of audit logs, CISA adds flaw to catalogue<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Insufficient logging in VMware ESX: an attacker with administrator privileges can carry out certain actions without them being logged. Applies to ESX, vSphere Foundation, Cloud Foundation and Telco Cloud Platform<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-41709<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">2.7<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, as a zero-day in early 2026 by Warp Panda (CrowdStrike). CISA added the flaw to the KEV catalogue on 28 October 2026, with a deadline of 11 November<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, since the Broadcom advisory of July 2026: ESXi80U3j-25429389, ESXi-9.0.2.0100-25595025, ESXi-9.1.0.0-25370933 and VCF 5.2.4<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/thehackernews.com\/2026\/10\/china-linked-hackers-exploited-vmware.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a>, this is set out in CrowdStrike&#8217;s Legal Threat Landscape Report. The Chinese espionage group Warp Panda, also known as Armory Castle (formerly UNC5221), Clay Typhoon and VerdantBamboo, exploited the flaw in early 2026 to reduce the visibility of the audit trail. The group gets in via internet-facing edge devices using zero-days and custom malware, then moves on to VMware vCenter and installs the BRICKSTORM and SharpStorm malware. The group sometimes steals cloud session tokens to access Microsoft 365, and in at least one case it registered a new MFA device to retain access after a password change. Earlier this month, Mandiant also attributed the zero-day in BeyondTrust Remote Support to Warp Panda.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>The low score is misleading. The flaw does not give the attacker access; it makes their activity invisible. An MSP managing ESX hosts for customers may, after a breach, find fewer log entries than actions that took place, leaving an incident investigation with too little evidence.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Install the fixes from Broadcom&#8217;s July advisory (see also the <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/10\/28\/cisa-adds-two-known-exploited-vulnerabilities-catalog\" target=\"_blank\" rel=\"noopener\">CISA alert<\/a>), even if your ESX hosts are not connected to the internet. Limit administrator accounts on ESX and vCenter, forward logs to an external log server and check vCenter for unknown MFA devices and unusual sessions.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"magento\">Critical upload flaw in Magento and Adobe Commerce exploited against web shops<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Unrestricted upload of files with a dangerous type in Adobe Commerce and Magento Open Source. Affected: Commerce 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, 2.4.4-p18 and earlier (and 2.4.9), Magento Open Source 2.4.8-p5, 2.4.7-p10 and 2.4.6-p15 and earlier, B2B 1.5.3 and earlier releases, Commerce Events 1.6.0 up to and including 1.20.0<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-48356<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">9.6<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, CISA added the flaw to the KEV catalogue on 27 October 2026. At publication in July, Adobe reported no exploitation yet<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, bulletin APSB26-73 of 14 July 2026: the 2026-jul releases (for example 2.4.8-2026-jul for Commerce and Magento Open Source) and Commerce Events 1.21.0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>According to the Dutch security news site <a href=\"https:\/\/www.security.nl\/posting\/959347\/Webwinkels+aangevallen+via+kritiek+beveiligingslek+in+Magento%2C+meldt+VS\" target=\"_blank\" rel=\"noopener\">Security.nl<\/a>, CISA reports attacks on web shops via this flaw, without giving details of the attacks. An unauthenticated attacker can upload dangerous file types to the web server. The <a href=\"https:\/\/www.adobe.com\/trust\/security\/products\/commerce\/apsb26-73.html\" target=\"_blank\" rel=\"noopener\">Adobe bulletin<\/a> names user interaction as a precondition and refers to possible privilege escalation.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>More than 100,000 web shops run on Magento or Adobe Commerce. Vulnerabilities in this platform are often used to steal customer data and credit card details. For an MSP or hosting provider with Magento customers, this counts double: the patch has been available for months, so a shop that is taken over now has missed a known update.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Check for each Magento installation whether the July 2026 patch (APSB26-73) has been installed. Search the upload folders and the webroot for unknown PHP files or other executable uploads. Also check the checkout page for injected scripts.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"mdm\">Attackers abuse MDM platforms as a backdoor: Hexnode and Rippling used to put ScreenConnect on endpoints<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Abuse of existing functionality: through phishing, victims enrol their device in an attacker-controlled MDM tenant (seen with Hexnode and Rippling), after which the attacker deploys ScreenConnect without authorisation as SYSTEM<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No CVE assigned<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, according to Huntress (28 October 2026)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, there is no software bug. Mitigation: inventory permitted MDM tenants and RMM instances and treat unexpected enrolments as incidents<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/www.huntress.com\/blog\/attackers-turn-mdm-into-remote-access\" target=\"_blank\" rel=\"noopener\">Huntress<\/a> (author Ben Nahorney), it starts with social engineering. In the first case, a user received a phishing email about a request for quotation, with an MSI posing as a DocuSign installer but containing a Hexnode MDM package. ScreenConnect was then installed with an attacker-controlled relay. The MSP removed ScreenConnect, but hours later it was back, because the MDM client had been left in place. In the second case, a receptionist clicked on a fake Teams calendar invitation. The device was enrolled in an attacker-controlled Rippling MDM tenant, the agent ran as SYSTEM and around 35 minutes later ScreenConnect followed.<\/p>\n<p><strong>What could the consequences be?<\/strong><\/p>\n<p>The MDM client is a trusted management channel, so security software regards it as normal. If you only remove the RMM tool, the attacker simply deploys it again. For MSPs this is particularly sensitive, because your own RMM and MDM look exactly the same to customers.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Keep an inventory of permitted MDM products, tenants, agents and RMM instances, and treat an unexpected enrolment as a security incident. An early warning sign in the second case was a new Rippling registry key. Isolate a suspicious endpoint, remove it from the unknown MDM tenant, revoke sessions and tokens, reset credentials and reinstall the device if its integrity cannot be established. Train users to be wary of unexpected meeting, signing and quotation requests.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A Linux kernel flaw turns PHP2Shell webshells into root shells, a VMware ESX zero-day masks logs, Magento stores are attacked and attackers abuse MDM platforms to deploy ScreenConnect.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"mspb_bron_id":1169473,"mspb_url_nl":"https:\/\/mspbusiness.com\/security-en-privacy\/patchwork-donderdag-29-oktober\/","mspb_url_de":"https:\/\/mspbusiness.com\/de\/security\/patchwork-donnerstag-29-oktober\/","mspb_url_en":"","mspb_beeld_url":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-G.png","mspb_beeld_klein":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-G-400x225.png","mspb_auteur":"Redactie","mspb_beeld_alt":"","mspb_video":"","_yoast_wpseo_metadesc":"Linux flaw Fragnesia and a VMware ESX zero-day are being exploited, Magento stores are under fire and MDM is used to deploy ScreenConnect.","footnotes":""},"categories":[3],"tags":[],"layout":[6],"class_list":["post-168","post","type-post","status-publish","format-standard","hentry","category-security","layout-news"],"_links":{"self":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/comments?post=168"}],"version-history":[{"count":1,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/168\/revisions"}],"predecessor-version":[{"id":169,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/168\/revisions\/169"}],"wp:attachment":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/media?parent=168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/categories?post=168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/tags?post=168"},{"taxonomy":"layout","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/layout?post=168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}