GoKawiilCISA mandates patch for Linux kernel flaw used with PHP2Shell exploit chain
CISA added CVE-2026-46300, a Linux kernel privilege-escalation bug dubbed Fragnesia, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by Saturday. The flaw, found in the XFRM ESP-in-TCP subsystem, grants root access and can reportedly be chained with two critical PHP vulnerabilities known as PHP2Shell to install webshells on unpatched systems.
GoKawiil's interpretation of the reporting above, not reported fact.
Dream Security researchers say they found evidence the three flaws were already combined in a real campaign that compromised over two dozen servers, including machines tied to a US government-affiliated organization, suggesting the chain is being actively weaponized rather than theoretical. Because Fragnesia affects kernels predating a May 2026 fix across major Linux distributions, the exposure window could be broad, and CISA's binding directive signals the agency views the risk to federal systems as urgent.
- CVE-2026-46300 (Fragnesia) is a Linux kernel bug enabling root-level code execution, added to CISA's KEV catalog.
- Attackers can reportedly chain it with PHP2Shell flaws (CVE-2026-109618/109619) to deploy webshells with root access.
- Dream Security says the exploit chain already compromised 25+ servers, including ones linked to a US government-affiliated entity.
Source: bleepingcomputer.com, 2026-10-29
Published there as: “CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.