CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on Oct 28, "based on evidence of active exploitation". Ransomware use is listed as unknown for both.

• CVE-2026-46300, Linux kernel ("Fragnesia"): a missing-initialization bug (CWE-456) in which the shared-fragment marker is lost during socket-buffer coalescing, so ESP input processing decrypts shared fragments in place and can modify page-cache-backed data. CISA's entry says it can be chained with PHP2Shell (CVE-2026-109618 and CVE-2026-109619) "to implant PHP webshells and run commands as root", which matches the firewall campaign Dream Research described. The federal due date is Oct 31, and it carries CISA's forensic-triage flag, meaning agencies must check for prior compromise, not just patch. CISA notes it affects an open-source component that may sit inside many products, and links eight stable-kernel fix commits.
• CVE-2026-41709, VMware ESX: an insufficient-logging flaw (CWE-778) that lets someone who already has admin access perform certain operations without them being logged. Broadcom rated it Low (CVSS 2.7) in VMSA-2026-0006 on July 29 and credited Ian Barton of CrowdStrike. Fixed builds are ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389, VCF 5.2.4, and KB449886 for Telco Cloud Platform. Due Nov 11, no forensic-triage flag.

What to do: update Linux kernels to a stable release containing the Fragnesia fix, starting with internet-facing hosts and appliances that run PHP, and check /etc/pam.d/su and other root-owned files against known-good copies (see hunt notes). For ESX, a low-severity bug in KEV usually means it was used to hide activity after an intrusion, so patch to the VMSA-2026-0006 builds and treat any ESX host with unexplained admin sessions as worth a closer look. CISA does not say whose exploitation evidence it relied on.