Summary
- Fragnesia is CVE-2026-46300, a Linux kernel privilege-escalation weakness.
- CISA says it can be chained with two PHP2Shell vulnerabilities.
- A PHP webshell and a kernel-level escalation represent distinct stages of compromise.
The US Cybersecurity and Infrastructure Security Agency has added Linux kernel vulnerability CVE-2026-46300 to its catalogue of known exploited weaknesses and linked it to attacks that also abuse the recent PHP2Shell flaws. The vulnerability, commonly called Fragnesia, can turn an initial foothold on a Linux host into execution with root privileges, extending the consequences of a web application compromise.
The flaw affects the Linux kernel’s XFRM ESP-in-TCP processing path and permits a local attacker to elevate privileges to root under vulnerable conditions. It belongs to the Dirty Frag class of Linux memory-management weaknesses. An attacker must already have a foothold from which to invoke the affected kernel behaviour; the Fragnesia bug alone is not described as an unauthenticated remote compromise of an internet-facing service.
CISA’s catalogue entry says CVE-2026-46300 can be chained with CVE-2026-109618 and CVE-2026-109619, the two PHP vulnerabilities already widely described as PHP2Shell. In such a chain, a web-facing vulnerability can provide an initial execution opportunity before the kernel weakness is used to raise privileges. The distinction is material: the first stage establishes a foothold, while the second can remove limitations that would otherwise constrain what the attacker can do.
Earlier PHP2Shell activity included remote command execution through two vulnerabilities in PHP. Where an attacker has gained control of a web application process but remains constrained by that account’s permissions, Fragnesia can be used as a second stage to reach root privileges. CISA’s catalogue entry and subsequent incident research describe that combination rather than a new PHP defect.
A host compromised before a PHP patch could retain unauthorised files or persistence after the externally reachable software is corrected. A system that was penetrated before the application fix could still contain unauthorised files or persistence. Conversely, repairing the kernel vulnerability without addressing the initial PHP weakness would leave a route back into the host. The two sets of patches address different parts of the same possible attack path.
CISA added Fragnesia on 28 October, giving US federal agencies a 31 October remediation deadline in its catalogue. That statutory deadline does not apply automatically to British or European private-sector operators, but it reflects an official assessment that the flaw is being exploited. Linux-based web servers, managed appliances and hosting platforms can share the relevant kernel heritage even where their administrators never interact directly with the kernel source.
Different Linux distributions and appliance manufacturers package kernel fixes on their own release schedules, so a single version number cannot describe every protected environment. An appliance may require a vendor firmware update instead of a conventional operating-system package. Nor does a generic report of a vulnerable kernel establish that a particular system is exploitable: the precise build, backported fix status and exposure path must be established separately.
The defect also changes the meaning of a successful initial web compromise. Web server processes are commonly separated from privileged administrative functions through operating-system user permissions. A local kernel escalation can erase that separation after an attacker obtains execution inside the web service, potentially exposing host-wide configuration and other local workloads. Public accounts of the Fragnesia exploitation chain describe this progression, but do not establish that all affected distributions or every PHP installation share identical exploit conditions. The actual combination of vulnerable software, deployment and privileges determines exposure.
Dream Security investigators identified an operation using the PHP2Shell vulnerabilities with Fragnesia and reported evidence of 25 rooted servers across the United States and Asia, including systems associated with a US government organisation. That does not establish that all PHP2Shell intrusions use this Linux escalation, or that every affected kernel build is exploitable in the same way. CISA’s exploited-vulnerability listing and the documented chain justify examining both the initial application compromise and subsequent privilege escalation.
