CISA has added the Linux kernel vulnerability known as Fragnesia to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. Separately, researchers reported that attackers combined it with PHP2Shell vulnerabilities to gain root privileges on 25 servers, including three in a U.S. government-affiliated environment.
The October 28 CISA alert identifies Fragnesia as CVE-2026-46300. Its inclusion makes remediation a priority for Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04. CISA also encourages other organizations to prioritize vulnerabilities in the catalog.
Fragnesia provides a way to escalate existing access. According to BleepingComputer’s October 29 report, the flaw lies in the Linux XFRM ESP-in-TCP subsystem, and a public proof-of-concept exploit allows local attackers to gain root privileges on major Linux distributions with kernels released before May 13, 2026.
The reported attack chain pairs that privilege escalation with PHP2Shell, the collective name for CVE-2026-109618 and CVE-2026-109619. BleepingComputer quoted CISA as saying the vulnerabilities can be chained to implant PHP webshells and run commands as root. Webshells let attackers issue commands through a compromised web server; root privileges give those commands the system’s highest level of access. CISA did not disclose details of the ongoing Fragnesia attacks.
Researchers describe a combined attack operation
Dream Security researchers said in a Monday report, quoted by BleepingComputer, that they found a customized PHP2Shell exploit chain paired with Fragnesia, along with target lists, exploitation logs and approximately 40 custom post-exploitation scripts.
The researchers said campaign artifacts showed that attackers had obtained root access on 25 servers across the United States, Japan, Taiwan and South Korea. They then focused on three servers in a U.S. government-affiliated environment. Those findings are Dream Security’s account; CISA’s public alert confirms exploitation of Fragnesia without identifying those targets or describing that campaign.
BleepingComputer also reported that Perplexity security engineer Adel Karimi observed remote code execution against an Apache mod_php installation running PHP 8.4.26 in honeypots over the preceding weekend. That observation concerns PHP2Shell exploitation and does not, by itself, establish use of the complete chain.
For affected organizations, the reported combination connects compromise of a PHP application with escalation to full system control. CISA’s directive prioritizes rapid remediation of cataloged vulnerabilities on publicly exposed assets that grant total control after exploitation. It also establishes expectations for checking whether attackers compromised a system before a patch was applied.
