CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks

What it is

Fragnesia (CVE-2026-46300) is a logic bug in the Linux XFRM ESP-in-TCP subsystem. It belongs to the Dirty Frag class and lets a local attacker run code as root. CISA added it to the KEV catalog and warned that it can be chained with PHP2Shell (CVE-2026-109618 and CVE-2026-109619) to implant PHP webshells and run commands as root.

How it works

The page gives no technical detail on either bug. It describes the chain only by role: PHP2Shell is the remote entry point, delivering PHP webshells, and Fragnesia is the local privilege escalation to root. Dream Security's report describes a custom weaponization of the PHP2Shell chain paired with Fragnesia. It also found target lists, exploitation logs and about 40 custom post-exploitation scripts.

Preconditions / Affected

• Fragnesia has a public PoC that works on major Linux distributions running kernels released before May 13, 2026.
• The PHP2Shell flaws are the reported route to a foothold on web servers. Perplexity security engineer Adel Karimi's honeypots recorded remote code execution against Apache mod_php running PHP 8.4.26.
• Dream tied the chain to 25 rooted servers across the United States, Japan, Taiwan and South Korea. The attacker then focused on three servers in a US government-affiliated environment.

What to do

The page names no commands or configuration changes. Its implied actions are:

• Update Linux kernels to a build released on or after May 13, 2026.
• Patch PHP, since PHP2Shell is exploited in the wild. The page does not list fixed PHP versions.
• Federal civilian agencies have BOD 26-04 deadlines. CISA added the PHP2Shell CVEs to KEV on a Monday with a Thursday deadline. It added Fragnesia on a Wednesday with a Saturday deadline. The page does not give the month for either.
• Treat any internet-facing PHP host that was unpatched against PHP2Shell as possibly rooted. Fragnesia needs only a local foothold, so a webshell is enough.

Caveats

• CISA did not share details of Fragnesia attacks. A CISA spokesperson could not confirm to BleepingComputer how attackers chain the two flaws.
• The chaining evidence comes from Dream Security's Monday report, which is the only source for the 25-server campaign.
• The page gives no detection queries, indicators of compromise or distribution-specific kernel package versions.