Skip to content
Centoculus

Security alert · High

Linux kernel flaw CVE-2026-46300 exploited in chain to plant PHP webshells

· 3 minutes read · Centoculus Security Team

Known since · attacks confirmed since

Affected: Linux kernel (affected versions: see the kernel commits and your distribution's advisory)

What happened

A vulnerability in the Linux kernel, tracked as CVE-2026-46300, is listed as actively exploited. It is a missing initialization of a variable. When the kernel coalesces socket buffers, it fails to preserve the marker that flags a fragment as shared. As a result, ESP (IPsec) input processing can decrypt shared fragments in place. This can lead to unintended modification of data backed by the page cache, meaning the in-memory copies of files.

The vulnerability has been public since May 23, 2026. CISA confirmed active attacks on October 28, 2026: systems that have not been updated since the disclosure are now at acute risk.

According to the source, attackers can chain this flaw with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. No CVSS score has been published yet.

Fixes have been committed to the stable Linux kernel trees. The commit links are listed in the sources below.

Who is affected

Linux servers running a kernel without these fixes are affected. The flaw sits in the kernel's ESP input path, which is part of IPsec. Web servers that run PHP deserve the most attention, because the known attack chain ends with PHP webshells and root command execution.

The source data does not list exact affected or fixed kernel versions. Check your distribution's security advisory, such as Debian, Ubuntu, RHEL/AlmaLinux/Rocky or SUSE, for the patched kernel package that matches your release.

What to do now

  1. Check your distribution's security tracker for CVE-2026-46300 and identify the fixed kernel package for your release.
  2. Install the updated kernel, for example with apt update && apt full-upgrade on Debian/Ubuntu or dnf update kernel on RHEL-based systems.
  3. Reboot the server so the new kernel is loaded. Installing the package alone does not protect a running system. If you use a kernel live-patching service, check whether it covers this CVE.
  4. After the reboot, confirm that the new kernel is running and that your web server, PHP-FPM, database and mail services have started correctly.
  5. Look up CVE-2026-109618 and CVE-2026-109619 and apply any updates available for the software they affect, because the known attack chain depends on them.
  6. If you cannot patch right away, prioritise internet-facing servers and follow your distribution's interim mitigation guidance, if any is published.

How to check whether you are affected

  • Run uname -r to see the running kernel and compare it with the fixed version in your distribution's advisory.
  • Make sure the running kernel matches the newest installed kernel package. A pending reboot leaves the server vulnerable.
  • Because the exploit chain is used to plant PHP webshells, search your web roots for recently modified or unexpected PHP files, for example with find /var/www -name '*.php' -mtime -30, and review any unfamiliar files.
  • Review web server access logs for requests to unknown PHP files, and check for unexpected processes, cron jobs or new users running as root.
  • If you find signs of compromise, treat the server as compromised. Isolate it, preserve logs for analysis and rebuild from a trusted source instead of only removing the files.

Sources

More sources (8)

More on Linux kernel

If you run Linux servers, also check

Related posts