CISA Warns of 'Fragnesia' Linux Flaw Used in PHP2Shell Attack Chains

Overview of the Threat

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a high-severity Linux kernel privilege escalation vulnerability, designated as CVE-2026-46300 and nicknamed "Fragnesia." This flaw is being actively exploited in the wild, often in combination with the "PHP2Shell" vulnerability chain.

Technical Details

Fragnesia is a logic bug residing within the Linux XFRM ESP-in-TCP subsystem. It is classified under the "Dirty Frag" vulnerability group. Exploitation allows local attackers to elevate their access to root-level permissions on affected Linux distributions. The vulnerability impacts kernels released prior to May 13, 2026.

The Attack Chain

Security researchers and CISA have identified a concerning trend where attackers link Fragnesia with two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), known collectively as PHP2Shell. The attack flow generally involves:

• Initial Access: Utilizing PHP2Shell to execute remote code and implant PHP webshells.
• Escalation: Chaining the access with Fragnesia to achieve root privileges.
• Post-Exploitation: Deployment of custom scripts to compromise specific targeted systems.

Reports from Dream Security indicate that over two dozen servers across the United States, Japan, Taiwan, and South Korea have been compromised, with specific targeting of U.S. government-affiliated environments.

Mandatory Remediation

Under Binding Operational Directive (BOD) 26-04, CISA has added both Fragnesia and the PHP2Shell flaws to its Known Exploited Vulnerabilities (KEV) Catalog. Federal agencies are mandated to patch these vulnerabilities by the specified deadlines:

• PHP2Shell (CVE-2026-109618/109619): Deadline set for Thursday.
• Fragnesia (CVE-2026-46300): Deadline set for Saturday the 10th.

Administrators should verify their Linux kernel versions and PHP installations (notably Apache mod_php versions like 8.4.26) against official security advisories to ensure they are not running vulnerable code.