CISA Warns of Fragnesia Linux Flaw Chained in PHP2Shell Attacks
The U.S. Cybersecurity and Infrastructure Security Agency warned federal agencies on Wednesday that attackers are using the high-severity Linux kernel vulnerability CVE-2026-46300, known as Fragnesia, together with the PHP2Shell vulnerabilities. The chain can allow malicious code to run with root permissions and has been used against unpatched systems.
Fragnesia is a logic flaw in the Linux XFRM ESP-in-TCP subsystem. A proof-of-concept exploit allows a local attacker to escalate privileges to root on major Linux distributions using kernels released before May 13, 2026. The evidence does not identify a fixed kernel version, so operators should use the applicable security update from their Linux distributor rather than rely on a version number supplied here.
CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog on Wednesday and ordered federal agencies to patch by Saturday 10 under Binding Operational Directive 26-04. CISA had separately added CVE-2026-109618 and CVE-2026-109619, the two PHP2Shell flaws, to the catalog on Monday and required Federal Civilian Executive Branch agencies to secure their networks by Thursday.
The PHP2Shell vulnerabilities can provide the initial route through an unpatched PHP installation, while Fragnesia can raise the attacker's privileges after access. CISA said the combination can implant PHP webshells and execute commands as root. Evidence of remote code execution was also recorded against an Apache mod_php installation running PHP 8.4.26, according to security engineer Adel Karimi's honeypots.
The scope of the operation is not fully documented by CISA. The agency did not provide details about ongoing Fragnesia attacks or confirm which threat actors may be chaining the vulnerabilities. Dream Security analysts nevertheless reported an operation involving the PHP2Shell chain and Fragnesia, with exploitation logs and post-exploitation scripts; they said 25 servers in the United States, Japan, Taiwan and South Korea had been rooted, including three in a U.S. government-affiliated environment.
Organizations running Linux kernels released before May 13, 2026 should identify whether their systems are affected and apply the relevant kernel security update. Operators of PHP deployments should also address CVE-2026-109618 and CVE-2026-109619; the available evidence does not state a general remediation version for either the kernel flaw or PHP2Shell.