Attackers chain PHP2Shell with Fragnesia kernel bug for root
Original title: PHP2Shell plus Fragnesia: A dangerous new route from web server to root
Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.
CISA warned that attackers are chaining PHP2Shell, two critical unauthenticated PHP remote-code-execution bugs, with CVE-2026-46300, a Linux kernel privilege-escalation flaw called Fragnesia. Dream Security reports operators gained root on vulnerable Palo Alto Networks PAN-OS firewalls with one unauthenticated HTTP request, then moved toward identity systems. Federal agencies were ordered to patch Fragnesia. The only stated fix for the kernel bug is a patched Linux version, and its payload is written to the page cache rather than disk.
Unconfirmed: Dream Security's count of 25 servers and its view that this was not a fully autonomous nation-state attack are disputed; a researcher says counts and attribution differ.
- CVE-2026-109618 and CVE-2026-109619 are both rated CVSS 9.2.
- Fragnesia belongs to the Dirty Frag local privilege-escalation class.
- Nearly two dozen firewalls were staged in the US, Japan, Taiwan and South Korea.
- Follow-on activity used a reverse SSH tunnel and Active Directory password spraying.
- Some tooling reportedly included Claude Code plus DeepSeek and Kimi.
Impact: Unauthenticated code execution escalated to root and directory access
| Product | Affected |
|---|---|
| PHP Foundation PHP | — |
| Linux kernel | — |
| Palo Alto Networks PAN-OS | vulnerable build |
- 1.Upgrade affected Linux systems to a patched version to fix CVE-2026-46300.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1572 Protocol TunnelingT1110.003 Password SprayingT1136.002 Create Account: Domain Account
- Vendors
- Palo Alto Networks
- Products
- PHPLinux kernelPAN-OS
- Organizations
- CISADream SecurityPHP Foundation
- Countries
- United StatesJapanTaiwanSouth Korea
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
5 min read at csoonline.com
The PHP2Shell saga continues, with attackers discovering new ways to exploit the critical vulnerability impacting millions of organizations worldwide. The US Cybersecurity and Infrastructure Security Agency (CISA) has warned of a high severity Linux kernel privilege escalation flaw that attackers are chaining with PHP2Shell bugs in the wild.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.