CISA Warns Fragnesia Linux Flaw Could Be Chained in PHP2Shell Attacks
Summary
CISA added the Fragnesia Linux kernel flaw (CVE-2026-46300) to its KEV Catalog and ordered federal patching, warning it could be chained with PHP2Shell. Dream Security says the chain rooted 25 servers; CISA has not detailed the attacks.
Key points
- Fragnesia (CVE-2026-46300) is a Linux kernel privilege-escalation flaw in the XFRM ESP-in-TCP subsystem that can let local attackers gain root access.
- A proof-of-concept reportedly affects major Linux distributions with kernels released before May 13, 2026.
- CISA added Fragnesia to its Known Exploited Vulnerabilities Catalog and directed federal agencies to patch by Saturday the 10th.
- CISA warned Fragnesia could be chained with PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
- Dream Security analysts said their investigation found an operation using the exploit chain that rooted 25 servers across four countries, including three at a U.S. government-affiliated organization; this is an analyst-reported finding.
- Perplexity security engineer Adel Karimi reported honeypot evidence of PHP2Shell remote code execution against an Apache mod_php installation running PHP 8.4.26.
Article Details
- Vulnerability Types
- Linux kernel privilege escalation caused by a logic bug in the XFRM ESP-in-TCP subsystem
- PHP remote code execution
- Severity
- High for CVE-2026-46300; critical for CVE-2026-109618 and CVE-2026-109619
- Affected Versions
- Linux kernel versions released before 2026-05-13
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- unknown
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationLocal attackers can exploit Fragnesia, a Linux kernel privilege-escalation flaw, to gain root privileges.T1190 · Exploit Public-Facing ApplicationPHP2Shell vulnerabilities were reportedly exploited for remote code execution against an Apache mod_php installation.T1505.003 · Web ShellCISA said the PHP2Shell and Fragnesia flaws could be chained to implant PHP webshells.
CVE
CVE-2026-109618attacks, but it noted that threat actors could chain it with two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, to deploy webshells on unpatched systems.CVE-2026-109619noted that threat actors could chain it with two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, to deploy webshells on unpatched systems.CVE-2026-46300Tracked as CVE-2026-46300 and known as Fragnesia, this vulnerability stems from a logic bug in the Linux XFRM ESP-in-TCP subsystem that lets attackers run malicious code with root permissions.
People
Products
Apacheexploitation over the weekend after their honeypots recorded evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26.LinuxCISA warns of Fragnesia Linux flaw chained in PHP2Shell attacksPHPdetails about ongoing Fragnesia attacks, but it noted that threat actors could chain it with two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, to deploy
Countries
Japan"This included artifacts of a campaign that had rooted 25 servers across the United States, Japan, Taiwan, and South Korea.South Korea"This included artifacts of a campaign that had rooted 25 servers across the United States, Japan, Taiwan, and South Korea.Taiwan"This included artifacts of a campaign that had rooted 25 servers across the United States, Japan, Taiwan, and South Korea.United StatesThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild.