CISA Orders Linux Kernel ‘Fragnesia’ Fix by Oct 31 as PHP2Shell Chain Roots 25 Servers

WASHINGTON — Federal civilian agencies have until Saturday, Oct. 31, to patch a Linux kernel flaw that attackers are chaining with critical PHP bugs to take full root control of internet-facing servers. The Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability, tracked as CVE-2026-46300 and nicknamed “Fragnesia” by researchers, to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday, Oct. 28, leaving agencies three days to act.

The kernel bug is the second half of an attack chain. Attackers first break in through the two “PHP2Shell” flaws in PHP, which give them code execution as a low-privilege web account, then use Fragnesia to escalate to root. Israeli security firm Dream says a suspected China-nexus operator used the chain to root 25 servers in the United States, Japan, Taiwan and South Korea, three of them inside a U.S. government-affiliated network.

CVE-2026-46300 at a Glance

What CISA Ordered

CISA added two flaws to the KEV catalog on Oct. 28: CVE-2026-46300 in the Linux kernel and CVE-2026-41709, an insufficient-logging flaw in Broadcom VMware ESX. Listing in the catalog means the agency has evidence of active exploitation.

Under Binding Operational Directive 26-04, federal civilian executive branch agencies must prioritize rapid remediation of high-risk vulnerabilities, especially on publicly exposed assets where exploitation grants total control of the system. The directive also sets expectations for when agencies must check whether attackers compromised a system before the patch was applied, a step that matters for this flaw because its tampering does not survive a reboot.

BOD 26-04 binds only federal civilian agencies, but CISA urges every organization to treat KEV entries as a patching priority.

How the Fragnesia Flaw Works

Fragnesia sits in the Linux kernel’s networking code. When the kernel merges socket buffers in the function skb_try_coalesce(), it drops a marker that flags a memory fragment as shared. IPsec ESP processing then decrypts data in place on top of memory that belongs to the page cache, the kernel’s in-memory copy of files on disk.

The result is that a local user can change the cached contents of files they are only allowed to read. Public exploits use this to tamper with privileged system files and gain root, while the copies on disk stay untouched.

“The kernel bug writes its payload into the page cache rather than to disk,” Aaron Beardslee, manager of threat research at Securonix, told CSO Online. That makes the privilege escalation invisible to disk-based integrity checks, and a routine reboot erases the evidence.

The flaw was first disclosed publicly in May as a variant of the “Dirty Frag” class of Linux privilege escalation bugs. Its fix is separate from the earlier Dirty Frag patches, so systems patched for those are not necessarily protected.

From Web Request to Root: The PHP2Shell Chain

On its own, Fragnesia requires an attacker to already be running code on the machine. The PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which PHP patched on Oct. 21, supply that foothold: both can be exploited remotely without logging in.

“PHP2Shell allows for remote access, but that access is typically limited by the account used to run the PHP service,” Scott Miserendino, chief technology officer at DataBee, told CSO Online. Chaining it with CVE-2026-46300, he said, gives the attacker unlimited access.

In the campaign Dream documented, the attacker ran commands as the restricted “nobody” web account, then used the kernel flaw to alter cached authentication settings and obtain root.

25 Servers, Three in a U.S. Government-Affiliated Network

According to Dream’s findings, reported by The Hacker News, the operator used the FOFA internet search engine to find about 19,000 internet-facing firewalls with exposed management interfaces. A custom scanner narrowed that to about 5,000 responsive devices, and filtering by country and by firmware running PHP 8.0.30 left 240 targets. Dream did not name the firewall vendor.

An automated batch tool then ran the PHP2Shell-Fragnesia chain, planted a PHP web shell, confirmed root access and logged the results. Dream’s timeline:

• Oct. 23, 6:14 p.m. UTC: The first government-affiliated firewall was rooted. It crashed shortly afterward and did not come back online.
• Oct. 24, 10:09 a.m. UTC: A second government-affiliated system was rooted.
• Oct. 24, 11:35 a.m. UTC: An internal firewall management server, reachable only through the attacker’s tunnel, was compromised, bringing the total to 25.

From inside the government-linked network, the attacker set up a persistent reverse SSH tunnel and went after Active Directory: trying to decrypt an LDAP service account password, enumerating users, spraying organization-themed passwords and attempting to create backdoor accounts. Dream said it is unclear whether those attempts succeeded.

Dream said the other 22 rooted firewalls still had active web shells and the tunnel into the U.S. government organization was likely still running at the time of its report. The firm also found AI tooling in the attacker’s infrastructure, including Anthropic’s Claude Code and an offensive scanning platform configured with the DeepSeek and Kimi language models. Dream said it notified the affected entity. Its account has not been independently verified.

Patched Kernel Versions

A patched kernel is the only complete fix. Fixed upstream stable releases are 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1. Major distributions have shipped updates:

RHEL 6 and 7 and Ubuntu 18.04 and 20.04 are listed as not affected. Live-patching services such as kpatch and Livepatch can bridge the gap until a reboot where they are available. Appliance owners should follow their vendor’s advisory rather than patching the underlying operating system themselves.

What Defenders Should Do Before the Deadline

1. Patch PHP and the kernel together. Closing PHP2Shell removes the remote entry point in this campaign; patching the kernel removes the path to root from any other foothold.
2. Reboot into the new kernel. Installing a kernel package does not protect a host until it is running. Compare uname -r with the installed version.
3. Disable IPsec ESP where it is not used. If a host does not terminate IPsec and cannot be patched yet, block and unload the esp4 and esp6 modules. This breaks IPsec and does nothing if ESP is compiled into the kernel.
4. Capture memory before rebooting suspect hosts. Because Fragnesia’s changes live in memory, a reboot destroys the evidence. Verify setuid binaries such as /usr/bin/su with rpm -V or debsums and save process and network state first.
5. Hunt for web shells and odd logins. Look for unexpected PHP files in web-reachable directories, shells or namespaces owned by web server accounts, and LDAP binds from hosts that should not hold directory credentials.

A quick triage on a Linux host:

# 1. Running kernel (compare with the fixed versions above)
uname -r

# 2. Are the IPsec ESP modules loaded?
lsmod | grep -E '^esp(4|6)'

# 3. Is IPsec actually in use on this host?
sudo ip xfrm state

# 4. No IPsec and no patched kernel yet: block and unload ESP
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\n' | sudo tee /etc/modprobe.d/cve-2026-46300.conf
sudo modprobe -r esp4 esp6

Why It Matters for Homeland Security

The campaign follows a familiar pattern: internet-facing network appliances that sit at the edge of government and critical infrastructure networks, run older software stacks and are hard to monitor from the inside. Earlier this month, CISA, the FBI and the NSA warned that a China-based company was supplying tools and infrastructure to actors targeting critical infrastructure worldwide.

Fragnesia was public for more than five months before it appeared in the KEV catalog. Organizations that deferred the kernel update because the flaw required local access now face a chain that supplies that access remotely. For federal agencies, the clock runs out Saturday.