CISA warns Fragnesia Linux flaw is being chained with PHP2Shell bugs
The agency told federal agencies to patch the kernel privilege escalation bug, which researchers say was used alongside two critical PHP flaws to root servers.
CISA has warned U.S. federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild, BleepingComputer reported on October 29.
The bug, tracked as CVE-2026-46300 and named Fragnesia, is a logic flaw in the Linux XFRM ESP-in-TCP subsystem that lets attackers run code with root permissions. It belongs to the Dirty Frag vulnerability class, and a proof-of-concept exploit exists for local attackers on major distributions with kernels released before May 13, 2026.
CISA added it to its Known Exploited Vulnerabilities catalog and set a Saturday deadline under BOD 26-04. The agency said the flaw "can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root."
Dream Security analysts said in a Monday report that the chain was used to root 25 servers across the United States, Japan, Taiwan and South Korea, including three in a U.S. government-affiliated environment. CISA has not named any threat actors.
What defenders should do
Treat internet-facing PHP as the entry point and the kernel as the escalation path. Inventory PHP versions and kernel builds, apply vendor updates, and check hosts for unexpected webshells and root-level activity. CISA's required action is to apply mitigations per vendor instructions or discontinue use where none exist.
CVE references
Sources
- CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacksPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning