CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks

Fragnesia is the name for CVE-2026-46300, a high-severity Linux kernel vulnerability. It belongs to the Dirty Frag class and affects kernels released before May 13, 2026. Its importance comes from the privilege it can provide: root access, which gives an attacker the highest level of control described in the article.

The flaw is a logic bug in the Linux XFRM ESP-in-TCP subsystem. A proof-of-concept exploit allows a local attacker to run malicious code with root permissions. That means an attacker who already has some access to a machine may be able to elevate privileges and take control of protected system functions.

CISA added Fragnesia to its Known Exploited Vulnerabilities Catalog after exploitation was reported in the wild. Dream Security said attackers used it with PHP2Shell to root 25 servers across four regions. Organizations running affected kernels should patch them, especially because the flaw can complete a broader web-server attack.

PHP2Shell is the collective name for CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities. The article describes them as remotely exploitable in the wild and says attackers can chain them to implant PHP webshells. This matters because a webshell gives attackers a way to issue commands through a compromised web server.

The reported chain targets unpatched systems. Perplexity security engineer Adel Karimi confirmed remote code execution after honeypots recorded activity against an Apache mod_php installation running PHP 8.4.26. CISA said the PHP flaws can be chained with Fragnesia, allowing attackers to implant PHP webshells and then run commands as root.

CISA added PHP2Shell to its actively exploited vulnerability list. Dream Security linked the chain to an operation that rooted 25 servers and used about 40 custom post-exploitation scripts. The evidence shows that unpatched PHP systems can become the first step in a larger compromise.

Dream Security analysts reported that the operation rooted 25 servers. The affected systems were spread across the United States, Japan, Taiwan, and South Korea. That geographic spread shows the campaign was not limited to one local network or one country.

The researchers also identified a specific focus within the campaign. After gaining root access, the attacker concentrated on three servers in a US government-affiliated environment. The article does not identify that organization by name, but it says the systems belonged to an environment affiliated with the US government.

The campaign included a custom PHP2Shell weaponization, exploitation logs, target lists, and approximately 40 post-exploitation scripts. CISA did not provide further details about the attackers or the ongoing activity. However, the reported server count and government-affiliated targets underline the importance of patching both PHP and Linux systems.

The chain combines two different stages of compromise. PHP2Shell can provide remote code execution on an unpatched PHP web server and help attackers implant a PHP webshell. Fragnesia then addresses the privilege problem by allowing a local attacker to execute malicious code with root permissions.

In the reported sequence, attackers first use PHP2Shell to reach the server and establish command execution. They can then use the webshell to run commands locally and trigger the Fragnesia exploit. CISA summarized the result as implanting PHP webshells and running commands as root.

That combination is dangerous because it joins access with maximum privilege. Dream Security said the operation rooted 25 servers and included about 40 custom post-exploitation scripts. Once systems are rooted, attackers can continue operating at the highest privilege level described in the report, although the article does not list every action they performed.

CISA added Fragnesia and PHP2Shell to its Known Exploited Vulnerabilities Catalog because the flaws were being used in real attacks. The agency warned that attackers could chain the PHP vulnerabilities with Fragnesia to compromise unpatched servers. Dream Security and Perplexity security observations supplied additional evidence of active exploitation.

For Fragnesia, CISA ordered federal agencies to patch by Saturday 10 under Binding Operational Directive 26-04. The article also says CISA added PHP2Shell to the actively exploited list and required Federal Civilian Executive Branch agencies to secure their networks by Thursday.

These deadlines make remediation a government requirement, not merely a recommendation. The article does not describe penalties or the exact patching process. It does show that agencies must address both vulnerability groups quickly because they can form a complete attack chain from remote access to root-level command execution.

Remote code execution means an attacker can make a vulnerable computer run commands from across a network. Local privilege escalation is different: it usually requires some existing local access, then exploits a flaw to obtain greater permissions. These are general security definitions; the article specifically associates remote execution with PHP2Shell and local escalation with Fragnesia.

The article’s chain illustrates the difference. PHP2Shell was used against an unpatched Apache mod_php installation, where honeypots recorded remote code execution. After access exists, Fragnesia’s local Linux kernel exploit can let the attacker run malicious code with root permissions.

Both stages are useful because they solve separate problems. Remote execution supplies the initial foothold, while privilege escalation expands control over the server. In this case, CISA said the combination can implant PHP webshells and run commands as root, producing a more serious compromise than either stage alone.

The Linux kernel is the central software layer that manages core system operations and hardware access. In the article, Fragnesia is a logic bug inside the kernel’s XFRM ESP-in-TCP subsystem. This places the vulnerability below ordinary applications and makes a successful exploit especially significant.

Fragnesia’s proof of concept lets a local attacker run malicious code with root permissions. Root is the top administrative privilege level on Linux. In general, that level can control protected files, services, processes, and system settings, although the article does not enumerate the attacker’s possible actions.

The reported chain demonstrates the risk. PHP2Shell can place a webshell on an unpatched server, and Fragnesia can then elevate the attacker’s local control to root. Dream Security said the combined operation rooted 25 servers, showing why kernel patches matter after an initial web-server compromise.