Good morning. Two new KEV entries, a crashing firewall zero-day, and a key-stealing implant on SD-WAN controllers. The common thread today is uncomfortable: the edge device you trust to protect the network is the target.
1. Linux kernel flaw now in CISA KEV: chained with PHP2Shell to plant webshells and run commands as root (CVE-2026-46300). CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 28, with a federal patch deadline of October 31. CISA says it can be chained with the PHP2Shell flaws to implant PHP webshells and run commands as root. Apply your distribution's kernel update and reboot so the new kernel is actually running, and hunt for unknown PHP files before you call the host clean, because CISA flags forensic triage for this one.
2. VMware ESX logging flaw now in CISA KEV: exploited as a zero-day to hide admin activity (CVE-2026-41709). CISA added the flaw to KEV on October 28, with a federal patch deadline of November 11. CrowdStrike reports the China-nexus group Warp Panda exploited it as a zero-day in early 2026 during attacks on the US legal sector, using it to perform admin operations without being logged after pivoting from edge devices into vCenter. Apply the July 2026 Broadcom builds, and do not let the low 2.7 CVSS score bury it: a logging blind spot is exactly what an intruder wants after stealing admin access.
3. Cisco firewall zero-day exploited to crash SSL VPN devices (CVE-2026-76418). Cisco patched the flaw on October 28 after finding active exploitation during October. An unauthenticated remote attacker can send a crafted request to the Remote Access SSL VPN service, when secondary authentication is configured on a tunnel group, and force the firewall to reload. That is a remote access outage, not a data theft story so far, but an outage at the VPN edge is an incident on its own. Patch ASA and FTD now, or disable secondary authentication on the affected tunnel groups until you can.
4. KeyDrift: Cisco SD-WAN controllers compromised to steal traffic encryption keys (CVE-2026-20127). Cisco Talos detailed the KeyDrift implant framework on October 28. After exploiting a February 2026 authentication bypass rated 10.0, the actor tracked as UAT-11473 installed a component that reads decrypted SD-WAN control traffic and pulls out the AES-256 keys passed between routers. Talos calls the attacks historical and has not confirmed whether stolen keys were sent. Patching a controller does not remove an implant already there and does not un-steal copied keys, so hunt the indicators and rotate keying material.
Warning: the PHP2Shell federal patch deadline is today, October 29. If PHP is still unpatched, today is the day.
Full writeups: kevinthecyberguy.com/vuln-watch
Indicators to hunt: kevinthecyberguy.com/ioc-library
New CISA KEV additions today: CVE-2026-46300, Linux Kernel, and CVE-2026-41709, Broadcom VMware ESX, federal due dates October 31 and November 11, 2026.
Principal Cybersecurity Engineer with 17+ years across banking, payments, and consulting. Writing about AI security, identity, and the fundamentals that stop most incidents. kevintswaney.com