Malicious actors are exploiting vulnerabilities in older Linux kernel versions and VMware ESX. They use them to cover their tracks or escalate their privileges after breaking in.
The U.S. cybersecurity agency CISA has confirmed the observed attacks by adding the flaws to its “Known-Exploited-Vulnerabilities” catalog. One affects Broadcom’s VMware ESX. It came to light at the end of July this year and affects the virtualization software’s logging. Admins can perform certain operations without them being logged (CVE-2026-41709, CVSS 2.7 , “ low ” risk). The low-risk rating seems too mild in light of the attacks — Broadcom is still standing by it. Cybersecurity firm CrowdStrike said in its report on the 2026 threat landscape for the legal sector, published Wednesday, that attackers from the “Warp Panda” group, which has ties to China, targeted U.S. companies in the legal sector. They planted various types of malware in the victims' VMware vCenter environments. They also used the logging flaw as a zero-day to cover their tracks.
On Tuesday, it emerged that the security flaw known as “php2shell” is now being successfully exploited . The attackers, who are also linked to China, used it in a suspected AI-assisted attack campaign in which they rooted (that is, took control of) 25 firewall servers in the U.S., Japan, Taiwan and South Korea, cybersecurity firm Dream reports — without naming the specific product affected. However, Palo Alto Networks has been warning since Wednesday active exploitation of the “php2shell” vulnerabilities in the PAN-OS firewall operating system; hotfixes are available to address the issue. After breaking in through “php2shell”, the attackers escalated their privileges on the target systems using the Linux kernel vulnerability known as “Fragnesia” . Microsoft warned the flaw (CVE-2026-46300, CVSS 7.8 , “ high ” risk) in mid-May this year; kernel updates have also been available for several months.
IT managers should check whether their environments still have servers running old software and install updates promptly where necessary. Broadcom has provided updates for VMware ESX since the end of July, and PHP developers patched the php2shell flaws last week.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
