CISA warns Fragnesia Linux kernel flaw is being chained with PHP2Shell in attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a high-severity privilege escalation vulnerability in the Linux kernel. According to the agency, attackers are already exploiting it in the wild as part of a chain with the PHP2Shell flaws.

What Fragnesia is

The vulnerability is tracked as CVE-2026-46300 and known as Fragnesia. It stems from a logic bug in the Linux kernel's XFRM ESP-in-TCP subsystem that allows malicious code to run with root permissions.

Fragnesia belongs to the Dirty Frag vulnerability class. A proof-of-concept (PoC) exploit is available, and local attackers can use it to gain root privileges on major Linux distributions running kernels released before May 13, 2026.

On Wednesday, CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) catalog. Under Binding Operational Directive BOD 26-04, federal agencies must update their systems by Saturday.

The PHP2Shell connection

The agency did not disclose details about the ongoing attacks. It did note, however, that Fragnesia can be combined with two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. The chain lets attackers deploy webshells on unpatched systems. "This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root," CISA said.

Analysts at Dream Security offered a fuller picture. In a report published Monday, they said the combination had been used to breach more than two dozen servers. The researchers uncovered evidence of a complete operation: a custom weaponized version of the PHP2Shell exploit chain paired with Fragnesia, target lists, exploitation logs, and roughly 40 post-exploitation scripts.

According to the report, the attackers gained root on 25 servers across the United States, Japan, Taiwan, and South Korea. They then focused on three servers in an environment belonging to an organization affiliated with the U.S. government.

Deadlines for agencies

CISA had already added the PHP2Shell flaws to its catalog of actively exploited vulnerabilities on Monday. Federal Civilian Executive Branch (FCEB) agencies must secure their networks by Thursday.

Perplexity security engineer Adel Karimi also confirmed active PHP2Shell exploitation over the weekend. The company's honeypots recorded remote code execution against an Apache mod_php installation running PHP 8.4.26.

A CISA spokesperson could not immediately provide BleepingComputer with further information about the threat actors using Fragnesia and PHP2Shell together.

Source: Bleeping Computer