---
title: Tip: four KEV clocks in two weeks. PHP2Shell Oct 29, Linux Fragnesia Oct 31 (with a compromise check), Magento and Brotli Nov 10, VMware ESX Nov 11 | ctxsec
url: https://ctxsec.com/items/tip-kev-deadlines-oct-29-31-nov-10-11
description: ""
status: "guidance (based on CISA KEV catalog, Oct 26-28)"
published: 2026-10-28
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-kev-deadlines-oct-29-31-nov-10-11.md)

guidance (based on CISA KEV catalog, Oct 26-28)

2026-10-28

### Tip: four KEV clocks in two weeks. PHP2Shell Oct 29, Linux Fragnesia Oct 31 (with a compromise check), Magento and Brotli Nov 10, VMware ESX Nov 11

Federal agencies must meet these under BOD 26-04; everyone else can use them as a priority list.

- **Oct 29:** [PHP2Shell](/items/cisa-kev-php2shell-cve-2026-109618-109619-due-oct-29). Update PHP and restart PHP-FPM or Apache.
- **Oct 31:** [Linux kernel Fragnesia](/items/kev-oct-28-linux-fragnesia-esx-logging-due-oct-31) (CVE-2026-46300). It is flagged for forensic triage, so after rebooting into a fixed kernel, also look for signs of earlier root compromise, especially on hosts that also ran a vulnerable PHP.
- **Nov 10:** [Magento PolyShell and the Brotli decoder](/items/kev-oct-27-magento-polyshell-brotli-due-nov-10).
- **Nov 11:** VMware ESX logging gap (CVE-2026-41709). Patch to the VMSA-2026-0006 builds.

A kernel fix only takes effect after a reboot (or a livepatch), so confirm with `uname -r` rather than the package manager.

Sources: [CISA alert: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 28)](https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog) · [CISA KEV catalog (JSON feed, Oct 28 entries)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) · [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)