Linux Fragnesia Flaw (CVE-2026-46300) Exploited for Root Access After PHP2Shell Attacks

On October 28, researchers described attackers exploiting Linux kernel vulnerability CVE-2026-46300 together with the PHP2Shell vulnerabilities to gain root privileges. That same day, CISA added the flaw to its catalog of actively exploited vulnerabilities. This is a new development in the PHP2Shell story: administrators also need to check the state of their system kernels.

What’s new

SecurityWeek reported findings from the firm Dream on attackers chaining CVE-2026-109618 and CVE-2026-109619 in PHP with the Fragnesia vulnerability in Linux. According to the researchers, attackers used this chain to gain root privileges on firewalls and to plant scripts that gave them persistent access.

A separate analysis by Oktsec notes that CISA added CVE-2026-46300 to its catalog on October 28 and links it to the two PHP vulnerabilities. The news is the exploitation of this kernel vulnerability. The flaw itself was disclosed earlier.

Why patching PHP isn’t enough

Fragnesia affects how the kernel processes network buffers and can allow local privilege escalation. In the attack chain described, it is the next step after attackers gain access through PHP.

For administrators, this means two layers need to be checked separately: the PHP environment and the operating system kernel. Any assessment must account for patches from the distribution vendor, which may be backported into maintained packages without moving to the latest major kernel version.

Confirmed attacks do not mean that every Linux server has been compromised. Your exposure has to be assessed for each specific installation.

What to do now

• Check with your OS vendor for the status of CVE-2026-46300 and whether the correct package is available.
• Verify your PHP patches separately from the kernel update.
• After updating, boot into the patched kernel following your distribution’s procedure, then confirm which kernel version is actually running.
• For network appliances, use the manufacturer’s software and follow its update instructions.
• If you suspect a breach, preserve available evidence and investigate unexpected files, processes and permission changes. A patch alone does not undo the effects of an attacker’s earlier access.

SecurHUB’s take

Attackers chaining vulnerabilities together shows why fixing a single flaw should take the whole affected system into account. Security incident response can help determine the scope of a breach and plan remediation based on the evidence collected.

Sources: SecurityWeek, Oktsec, Breach Briefing