CVE-2026-46300: a Linux kernel bug next to the PHP bugs
On 28 October CISA added CVE-2026-46300 to the known-exploited catalog. It is a local kernel bug. It has already been chained with the two critical PHP bugs to run commands as root.
A PHP patch closes the interpreter. It does not update the kernel of the machine that interpreter runs on. CVE-2026-46300 is about the machine. CISA says it was used together with CVE-2026-109618 and CVE-2026-109619: code on the site first, then commands as root. For a storefront owner the fork is simple. You updated PHP and did not reboot onto a new kernel - you locked the flat and left the stairwell open.
What this does not mean
This is not another WordPress hole, and it is not by itself a way onto any Linux host from the internet. Trackers score it around 7.8, which looks calm next to a PHP 9. The calm is misleading: the 7 becomes root once the same machine already runs code as the web server user. The packet-fragment mechanics are not worth retelling. The fact and the distro patch are enough to decide.
What to do
- Install the kernel update from your distribution and reboot. A package sitting in the cache without a reboot does not count.
- Do not park this for "the night after PHP." CISA describes them as one chain, not two unrelated headlines.
- If foreign files were already on the site, a kernel is not enough. Look at processes and the tree. A patch does not erase history.
Related Lexora services
PHP is updated, the kernel was left alone
We can check which kernel build is actually running, not which one is listed in the package cache.