Linux kernel "Fragnesia" exploited alongside PHP2Shell; WordPress 7.1.4 security release

Linux kernel "Fragnesia": CVE-2026-46300

• What: CVE-2026-46300, a local privilege escalation in the Linux kernel. Attackers are pairing it with PHP2Shell to turn a web shell into full root access.
• Severity: High (7.8); requires local access.
• Exploited: Yes. On CISA's Known Exploited Vulnerabilities catalog, with a federal remediation deadline of October 31.
• Fixed in:
  • Debian 11: linux 5.10.257-1 (DLA-4606-1), or 6.1.174-1~deb11u1 for the 6.1 kernel.
  • Amazon Linux 2023: ALAS2023-2026-1710.
  • Amazon Linux 2: ALAS2-2026-3307.
• What to do: Install the patched kernel and reboot. Servers that ran a vulnerable PHP build while PHP2Shell was being exploited should also complete a compromise check.

WordPress 7.1.4 security release

• WordPress 7.1.4 fixes:
  • a remote code execution bug during upgrades;
  • several stored cross-site scripting bugs;
  • a way for logged-out visitors to find unpublished Customizer changes.
• The release notes do not list CVE IDs, and no exploitation had been reported at release time.
• What to do: Update WordPress sites to 7.1.4.

AWS bulletin on Brotli

• AWS published bulletin 2026-155-AWS covering CVE-2026-111497, which is already on the exploited list.
• AWS is updating AWS Lambda, AWS Amplify and some other services, but some of them require customer action.
• Check the bulletin to see whether your Lambda functions or Amplify apps need a redeploy or a runtime update.