CISA Issues Urgent Warning Regarding Chained Linux Kernel and PHP Vulnerabilities in Active Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned federal agencies to patch a high-severity Linux kernel privilege escalation bug, Fragnesia, which threat actors are chaining with PHP2Shell flaws to deploy webshells.
BleepingComputer
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory concerning a critical Linux kernel privilege escalation vulnerability, CVE-2026-46300, also known as Fragnesia. CISA has mandated that federal agencies patch their systems by Saturday, October 10, 2026, under Binding Operational Directive (BOD) 26-04.
Fragnesia is a high-severity vulnerability rooted in a logic bug within the Linux XFRM ESP-in-TCP subsystem. This flaw allows local attackers to execute malicious code with root permissions on major Linux distributions running kernels released before May 13, 2026. CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) Catalog on Wednesday.
CISA noted that threat actors are actively chaining Fragnesia with two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell. This combination allows attackers to deploy PHP webshells and execute commands as root on unpatched systems.
While CISA did not disclose specifics regarding the ongoing attacks, Dream Security analysts reported that the vulnerabilities have been used to breach over two dozen servers globally. Their Monday report detailed a complete attack operation involving a custom weaponization of the PHP2Shell exploit chain paired with the Fragnesia kernel escalation.
Dream Security researchers identified artifacts from a campaign that successfully rooted 25 servers across the United States, Japan, Taiwan, and South Korea. The group noted that attackers zeroed in on three specific servers within a US government-affiliated environment.
In addition to the kernel flaw, CISA also added the PHP2Shell vulnerabilities to its list of actively exploited vulnerabilities on Monday, mandating that Federal Civilian Executive Branch (FCEB) agencies secure their networks by Thursday.
Perplexity security engineer Adel Karimi confirmed in-the-wild exploitation over the weekend, noting that their honeypots recorded evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26.
CISA confirmed the active exploitation of the PHP2Shell vulnerabilities but did not provide further details regarding the specific methods threat actors are using to chain Fragnesia and PHP2Shell in their attacks.