[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

guidance (based on CISA KEV catalog, Oct 26-28)

Tip: four KEV clocks in two weeks. PHP2Shell Oct 29, Linux Fragnesia Oct 31 (with a compromise check), Magento and Brotli Nov 10, VMware ESX Nov 11

Federal agencies must meet these under BOD 26-04; everyone else can use them as a priority list.

  • Oct 29: PHP2Shell. Update PHP and restart PHP-FPM or Apache.
  • Oct 31: Linux kernel Fragnesia (CVE-2026-46300). It is flagged for forensic triage, so after rebooting into a fixed kernel, also look for signs of earlier root compromise, especially on hosts that also ran a vulnerable PHP.
  • Nov 10: Magento PolyShell and the Brotli decoder.
  • Nov 11: VMware ESX logging gap (CVE-2026-41709). Patch to the VMSA-2026-0006 builds.

A kernel fix only takes effect after a reboot (or a livepatch), so confirm with uname -r rather than the package manager.

Sources: CISA alert: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 28) · CISA KEV catalog (JSON feed, Oct 28 entries) · CISA KEV catalog