Skip to content
audiotale.net
Sign in
NewsNews

CVE-2026-46300 Fragnesia: Linux root flaw on CISA KEV, chained with PHP2Shell

CISA says the Linux kernel bug Fragnesia is exploited together with the PHP2Shell flaws; Dream reports 25 servers rooted. Here is who is affected and how to patch.

audiotale.net team

· 8 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. How the chain works
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

CISA added the Linux kernel flaw Fragnesia (CVE-2026-46300) to its Known Exploited Vulnerabilities catalog on 28 October 2026, and security firm Dream says attackers chained it with the critical PHP2Shell bugs to take root on 25 servers, mostly firewall appliances. The kernel bug has had a fix since May. The PHP bugs were patched on 21 October. Any server that runs PHP and an unpatched kernel is therefore exposed to a two-step path from a web request to root, and the federal deadline is 31 October.

Key points

  • CVE-2026-46300 ("Fragnesia") is a local privilege escalation in the Linux kernel's XFRM ESP-in-TCP code; it was disclosed on 13 May 2026 with a public exploit, and its CVSS 3.1 score is listed as 7.8 by Tenable.
  • CISA added it to the KEV catalog on 28 October 2026 with a due date of 31 October, according to the HOL Guard record of the catalog entry.
  • Dream reports that attackers chained a custom PHP2Shell exploit (CVE-2026-109618 and CVE-2026-109619) with Fragnesia to gain root on 25 servers, including a US government-affiliated network.
  • PHP fixed PHP2Shell in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026; fixed upstream kernels include 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174 and 5.15.208.
  • Blocking the esp4, esp6 and rxrpc kernel modules cuts off the attack path until you can reboot into a patched kernel, but it breaks IPsec ESP and AFS workloads.

What to do

Who is affected. Any Linux system running a kernel built before the 13 May 2026 fix, where an attacker can already run code as an ordinary user. A PHP web shell running as the web server account is exactly that. Tenable says Ubuntu, RHEL, openSUSE, CentOS Stream, Debian and Gentoo were vulnerable when it wrote its FAQ, while AlmaLinux and Fedora had patches and Amazon Linux is not affected because it does not ship the espintcp module. Distribution status changes quickly, so check your vendor's advisory for CVE-2026-46300 rather than relying on that snapshot. Canonical lists Ubuntu 20.04 and older on standard kernels as not affected, per the HOL Guard record.

Patch the kernel.

  • Upstream stable fixes: 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174 and 5.15.208 (commit f84eca581739).
  • AlmaLinux: kernel-4.18.0-553.124.3.el8_10 (AlmaLinux 8), kernel-5.14.0-611.54.5.el9_7 (9) and kernel-6.12.0-124.56.3.el10_1 (10). Run sudo dnf clean metadata && sudo dnf upgrade, then reboot.
  • Other distributions: install the kernel package your vendor lists for the CVE and reboot. A kernel update does nothing until the machine boots into it.

Patch PHP too. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to your distribution's backport. Distributions keep the old upstream version number on backports, so on AlmaLinux confirm with rpm -q php-common, not php -v. PHP 8.1 and older have no official fix.

If you cannot reboot yet. AlmaLinux publishes this stopgap, which also covers Fragnesia if you had already applied the Dirty Frag version of it:

sudo sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/fragnesia.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true"

It breaks anything that uses IPsec ESP or AFS/rxrpc, so on VPN gateways the patched kernel is the real fix. For PHP2Shell, AlmaLinux suggests turning off session upload progress in the PHP configuration (not with ini_set() or .user.ini, which is too late) and lowering post_max_size.

Check whether you were hit. Fragnesia changes a file only in memory (the page cache), so a reboot or a cache drop erases both the backdoor and the evidence. HOL Guard advises checking for page-cache tampering before you reboot or patch. Dream saw attackers overwrite /etc/pam.d/su with pam_permit.so, so compare the files on disk with what your package manager expects, look for unfamiliar PHP files in web roots, and review logs for odd multipart uploads. CISA flagged the entry for forensic triage, so US federal agencies must look for compromise, not just patch.

What happened

On 28 October 2026 CISA added CVE-2026-46300 to the KEV catalog, which lists vulnerabilities with confirmed exploitation. BleepingComputer reports that CISA says Fragnesia can be chained with the PHP2Shell flaws to drop PHP web shells and run commands as root. CISA has not published details of the attacks it has seen.

The most concrete account comes from Dream, a security company that published an investigation in late October. It says a custom PHP2Shell exploit gave attackers a foothold, and Fragnesia then gave them root on 25 machines: 24 perimeter firewalls and one internal management server, in the United States, Japan, Taiwan and South Korea. The victims included a US government-affiliated environment. Dream says it could confirm credential extraction and directory enumeration, but not whether a password spray, the creation of backdoor accounts or theft of SAML signing keys succeeded. It did not name the firewall vendor or product versions and says it has notified the vendor. We could not find an independent confirmation of the 25-server figure, so treat it as Dream's own count.

PHP2Shell itself was already on the KEV list. BleepingComputer reports CISA added both PHP CVEs on Monday 26 October and gave federal agencies until Thursday 29 October. Perplexity security engineer Adel Karimi confirmed exploitation in the wild after his honeypots recorded remote code execution against Apache mod_php running PHP 8.4.26, and one account counts 35 shells on his decoy servers. Amazon's MadPot honeypots recorded an attempt on 17 October, four days before the fix was public, according to Help Net Security.

Background

Fragnesia was disclosed on 13 May 2026 by William Bowling of V12 Security, together with a public proof of concept; the CVE was assigned the same day. AlmaLinux called it the third local-root flaw in this area of the kernel in under two weeks, after Dirty Frag. The fix, titled "net: skbuff: preserve shared-frag marker during coalescing", was merged into the netdev tree on 21 May.

Fragnesia and Dirty Frag are the same class of bug: they get a write into the page cache, the kernel's in-memory copy of files, through the XFRM/ESP networking code. Tenable notes that the two are distinct. Dirty Frag uses a 4-byte store; Fragnesia enters through TCP coalescing in ESP-in-TCP and has a 192-byte XOR write primitive. Machines that only received the Dirty Frag patches are still vulnerable and need their own Fragnesia fix, while the module blocklist protects against both.

The public exploit is simple to describe. It needs a local user on a vulnerable kernel, no race condition, and it uses user and network namespaces, enabled by default on most distributions, to obtain the network capability it needs without host privileges. One published description says the exploit modifies the in-memory copy of /usr/bin/su so that running it gives a root shell while the file on disk stays unchanged.

PHP2Shell is a pair of critical PHP bugs disclosed on 21 October 2026. CVE-2026-109618 is memory corruption when a request hits PHP's memory limit, which a crafted multipart upload can trigger. CVE-2026-109619 is stale state left after a request ends on a fatal error, reachable through session upload progress (on by default) or through warnings raised by per-directory settings. AlmaLinux says PHP confirmed remote code execution against both mod_php and PHP-FPM for the second bug, and considers mod_php on AlmaLinux 8 the highest-risk setup. Scores differ by source: the vendor rates both 9.2 on CVSS 4.0, while NVD shows 9.8 and 8.1 on CVSS 3.1, according to Pentestit.

How the chain works

The chain splits the work between two bugs that each fall short alone. PHP2Shell is remote but runs as the web server account, a low-privilege user. Fragnesia is local but needs code already running on the box. Together they turn an unauthenticated upload into root, which on a firewall or gateway means control of the network's edge.

Step Flaw What the attacker gets
1 PHP2Shell (CVE-2026-109618 or CVE-2026-109619) Code execution as the web server user, usually a PHP web shell
2 Fragnesia (CVE-2026-46300) Root, by rewriting the in-memory copy of a read-only file
3 Dream's reported follow-up Credential extraction and, in one case, an attempt on internal identity systems

What it means

For operators, the practical lesson is that "local" kernel bugs stop being low priority once any internet-facing service can be turned into a local shell. A flaw patched in May that a team deprioritised because it needed local access became urgent as soon as a remote PHP bug supplied the access. Web hosts, shared-hosting providers and appliance makers that embed PHP in a management interface carry the most risk, because a single PHP bug there reaches a kernel that may be older than May.

For appliance owners the news is harder, because they cannot update the kernel themselves. Dream did not name the vendor, so the only advice we can responsibly give is to ask your firewall vendor whether its firmware contains PHP and a kernel from before the fix, and to keep management interfaces off the public internet.

For defenders, the in-memory nature of the write cuts both ways. Nothing is left on disk, which frustrates file integrity monitoring, but the trace disappears on reboot, so patching first can destroy the evidence you need.

What we don't know yet

  • Which firewall or appliance vendor Dream's victims used, and which firmware versions are affected.
  • Whether other groups run the same chain, since CISA has not described the attacks it observed.
  • How many of the 25 compromised servers went further than credential theft; Dream could not confirm the later stages.
  • Whether Dream's 25-server count is borne out by anyone else. We found no independent confirmation.
  • A third PHP vector, CVE-2026-115560, which one summary of the PHP advisory says is not fixed in these releases. We could not verify this against PHP's own advisory, so confirm it before relying on the patch alone.

What to watch next

  • Vendor advisories from firewall and appliance makers that bundle PHP.
  • The PHP release that fixes the remaining vector, if it exists, and updated guidance on session.upload_progress.enabled.
  • Distribution kernels: RHEL, Ubuntu and Debian users should look for updated packages for CVE-2026-46300, since our sources disagreed on their status.
  • CISA's follow-up if it publishes details of the observed attacks.

For more on defending against fast-moving server attacks, see our coverage of the Cisco ASA and FTD SSL VPN flaw exploited to reload firewalls.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next