The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug, tracked as CVE-2026-46300 and named Fragnesia. In a Monday report, Dream Security analysts said the vulnerabilities were used to breach more than two dozen servers, including three belonging to a U.S. government-affiliated organization.
CISA added Fragnesia to its Known Exploited Vulnerabilities (KEV) Catalog on Wednesday and ordered federal agencies to patch their systems by Saturday 10, as required by its Binding Operational Directive (BOD) 26-04. The agency also added the PHP2Shell flaws to its list of actively exploited vulnerabilities on Monday and mandated that Federal Civilian Executive Branch (FCEB) agencies secure their networks by Thursday.
Fragnesia stems from a logic bug in the Linux XFRM ESP-in-TCP subsystem and belongs to the Dirty Frag vulnerability class. A proof-of-concept exploit exists that local attackers can use to gain root privileges on major Linux distributions with kernels released before May 13, 2026. Dream Security analysts said in a Monday report that they identified a complete attack operation including a custom weaponization of the PHP2Shell exploit chain paired with Fragnesia, target lists, exploitation logs, and approximately 40 custom post-exploitation scripts.
"This included artifacts of a campaign that had rooted 25 servers across the United States, Japan, Taiwan, and South Korea. Once rooted, the attacker zeroed in on three specific servers in a US government-affiliated environment," Dream analysts said. CISA did not share details about ongoing Fragnesia attacks but noted that threat actors could chain it with the PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, to implant PHP webshells and run commands as root.
Separately, Perplexity security engineer Adel Karimi confirmed in-the-wild exploitation over the weekend after their honeypots recorded evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26. A CISA spokesperson couldn't immediately share more information about threat actors potentially chaining Fragnesia and PHP2Shell in attacks when reached by BleepingComputer.
Analysis
Why This Matters
- The chaining of a kernel privilege escalation flaw with critical PHP vulnerabilities allows attackers to gain full root access and deploy persistent webshells, posing a severe risk to unpatched systems.
- CISA's binding order requires federal agencies to patch within days, underscoring the urgency and confirmed active exploitation.
- The campaign breached US government-affiliated servers, raising concerns about national security and data integrity.
Background
Fragnesia (CVE-2026-46300) is a Linux kernel vulnerability in the XFRM ESP-in-TCP subsystem, classified as part of the Dirty Frag vulnerability class. It allows local attackers with a proof-of-concept exploit to escalate privileges to root on major Linux distributions with kernels before May 13, 2026. PHP2Shell refers to two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that enable remote code execution; Dream Security reported they were used alongside Fragnesia in targeted campaigns.
Key Perspectives
CISA: warns that the Fragnesia flaw can be chained with PHP2Shell vulnerabilities to implant PHP webshells and run commands as root, and has mandated federal agencies to patch by set deadlines.
Dream Security analysts: identified a full attack operation that rooted 25 servers across the US, Japan, Taiwan, and South Korea, with three servers in a US government-affiliated environment specifically targeted.
Perplexity security engineer Adel Karimi: confirmed in-the-wild exploitation of PHP2Shell after honeypots recorded remote code execution against an Apache mod_php installation running PHP 8.4.26.
What to Watch
- Whether FCEB agencies meet the November 10 patching deadline for Fragnesia and the earlier Thursday deadline for PHP2Shell.
- Additional details from CISA or security researchers about the threat actor behind the chained attacks.
- Potential expansion of the campaign to targets beyond the five countries already affected.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedCISA warned that Fragnesia was being exploited alongside PHP2Shell vulnerabilities.BleepingComputer: “The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild.”
- SupportedFederal agencies were ordered to patch Fragnesia by Saturday 10.BleepingComputer: “CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) Catalog on Wednesday and ordered federal agencies to patch their systems by Saturday 10, as mandated by its Binding Operational Directive (BOD) 26-04.”
- SupportedDream Security reported that the campaign rooted 25 servers, including three in a US government-affiliated environment.BleepingComputer: “This included artifacts of a campaign that had rooted 25 servers across the United States, Japan, Taiwan, and South Korea. Once rooted, the attacker zeroed in on three specific servers in a US government-affiliated environment.”
- SupportedCISA warned federal agencies to patch a high-severity Linux kernel privilege-escalation bug tracked as CVE-2026-46300 and named Fragnesia.BleepingComputer: “The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild. Tracked as CVE-2026-46300 and known as Fragnesia”
- SupportedDream Security analysts said in a Monday report that the vulnerabilities were used to breach more than two dozen servers, including three belonging to a US government-affiliated organization.BleepingComputer: “Dream Security analysts said in a Monday report that the vulnerabilities were used to breach more than two dozen servers, including three belonging to a US government-affiliated organization.”
- SupportedCISA added Fragnesia to the KEV Catalog on Wednesday and set the Saturday 10 deadline under BOD 26-04.BleepingComputer: “CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) Catalog on Wednesday and ordered federal agencies to patch their systems by Saturday 10, as mandated by its Binding Operational Directive (BOD) 26-04.”
- SupportedCISA added the PHP2Shell flaws to its list of actively exploited vulnerabilities on Monday and required FCEB agencies to secure their networks by Thursday.BleepingComputer: “CISA also added the PHP2Shell flaws to its list of actively exploited vulnerabilities on Monday and mandated that Federal Civilian Executive Branch (FCEB) agencies secure their networks by Thursday.”
- SupportedFragnesia stems from a logic bug in the Linux XFRM ESP-in-TCP subsystem.BleepingComputer: “this vulnerability stems from a logic bug in the Linux XFRM ESP-in-TCP subsystem”
- SupportedA proof-of-concept exploit can let local attackers gain root privileges on major Linux distributions with kernels released before May 13, 2026.BleepingComputer: “Fragnesia belongs to the Dirty Frag vulnerability class and has a proof-of-concept (PoC) exploit that local attackers can use to gain root privileges on major Linux distributions with kernels released before May 13, 2026.”
- SupportedThe quoted passage about a campaign rooting 25 servers and targeting three servers in a US government-affiliated environment is attributed to Dream analysts.BleepingComputer: “"This included artifacts of a campaign that had rooted 25 servers across the United States, Japan, Taiwan, and South Korea. Once rooted, the attacker zeroed in on three specific servers in a US government-affiliated environment."”
- SupportedCISA said threat actors could chain Fragnesia with PHP2Shell to implant PHP webshells and run commands as root.BleepingComputer: “"This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root," CISA said .”
- SupportedPerplexity security engineer Adel Karimi confirmed in-the-wild exploitation after honeypots recorded evidence of remote code execution against Apache mod_php running PHP 8.4.26.BleepingComputer: “Perplexity security engineer Adel Karimi confirmed in-the-wild exploitation over the weekend after their honeypots recorded evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26.”
