CISA warns Fragnesia Linux flaw is chained in PHP2Shell attacks
Original title: CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
Agencies must patch CVE-2026-46300 by Saturday 10; researchers say the chain rooted 25 servers, including three US government-affiliated hosts.
CISA added the high-severity Linux kernel bug CVE-2026-46300, called Fragnesia, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by Saturday 10 under BOD 26-04. The logic flaw in the XFRM ESP-in-TCP subsystem can yield root, and CISA said it can be chained with PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells. Dream Security said the chain rooted 25 servers in the United States, Japan, Taiwan and South Korea. A public PoC exists for kernels released before May 13, 2026.
Unconfirmed: Dream Security's claim of 25 rooted servers and three US government-affiliated targets is not confirmed by CISA.
- Fragnesia is a Dirty Frag-class local privilege escalation with a public PoC.
- PHP2Shell was added to the KEV catalog on Monday, with an FCEB deadline of Thursday.
- Perplexity's Adel Karimi reported honeypot RCE against Apache mod_php on PHP 8.4.26.
- CISA did not publish attacker details, and a spokesperson had no further information.
Impact: Root code execution and PHP webshells running commands as root
| Product | Affected |
|---|---|
| Linux kernel | kernels released before May 13, 2026 |
| PHP | — |
- 1.Patch CVE-2026-46300 on federal systems by Saturday 10 under BOD 26-04.
- 2.Secure networks against PHP2Shell; FCEB agencies were told to do so by Thursday.
- ATT&CK
- T1068 Exploitation for Privilege EscalationT1190 Exploit Public-Facing ApplicationT1505.003 Web Shell
- Products
- Linux kernelPHP
- Organizations
- CISADream Security
- Countries
- United StatesJapanTaiwanSouth Korea
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
From the original article
2 min read at bleepingcomputer.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild.
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.