Ing. Calogero Bono
CISA, the US cybersecurity agency, has added Fragnesia (CVE-2026-46300), a Linux kernel flaw, to its catalog of actively exploited vulnerabilities. Attackers are chaining it with PHP2Shell, two critical PHP flaws, to gain root access. According to Dream, one campaign compromised 25 servers across four countries. This matters to anyone running a Linux server with PHP, which means a large share of websites.
A few terms before we get into the facts. A privilege escalation is a flaw that lets someone with limited access gain higher permissions, such as root. The KEV is the CISA catalog of vulnerabilities already exploited in real attacks. A webshell is a script uploaded to a web server that lets someone run commands remotely. ESP-in-TCP is part of the kernel XFRM subsystem, tied to IPsec encrypted traffic. A PoC is a demonstration exploit.
What is Fragnesia?
According to the Debian security tracker, the problem lies in the kernel function skb_try_coalesce(). When it merges network packet fragments, it can drop the SKBFL_SHARED_FRAG flag. That flag indicates the fragments belong to external memory or the page cache.
The trouble comes next. The incoming ESP code checks the flag to decide whether to skip copying the data. If the flag is missing, it can decrypt in place over fragments that sit in the page cache. The fix propagates the flag when fragments are transferred.
According to BleepingComputer, Fragnesia belongs to the Dirty Frag class and has a PoC that a local attacker can use to become root on major distributions running kernels released before May 13, 2026. The CVSS score is 7.8, according to The Hacker News.
How does the attack chain work?
Fragnesia on its own requires local access. This is where PHP2Shell comes in, namely CVE-2026-109618 and CVE-2026-109619, with a CVSS score of 9.2. According to The Hacker News, they allow remote code execution without authentication on systems running vulnerable PHP versions.
CISA says the kernel flaw can be chained with the two PHP ones to install webshells and run commands as root. In practice, the first step enters through the web, and the second turns that foothold into administrator control of the machine.
Dream, an Israeli security company, described a campaign using a custom PHP2Shell exploit, Fragnesia, target lists, logs and about 40 post-exploitation scripts. The compromised servers are 25 across the United States, Japan, Taiwan and South Korea. Three belonged to an environment linked to the US government. Dream points to a suspected actor linked to China, but that is the company's assessment.
What does Palo Alto Networks have to do with it?
Palo Alto Networks warned that the PHP2Shell flaws are being exploited against management interfaces exposed to the internet. According to the company, no special configuration is needed to be hit, and the risk is maximum on PAN-OS with external access. It concerns only the web management interface, meaning HTTPS and XML API, and the dataplane only if it has a management profile.
Dream did not name the firewall vendor. The Hacker News believes the facts may be connected, but that is the outlet's inference, not a confirmation.
Which versions need updating?
PHP fixed the flaws on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. BleepingComputer reports that a researcher saw real attacks against an Apache mod_php installation running PHP 8.4.26, just one version before the fix.
For the kernel, the date to check is the one BleepingComputer cites, May 13, 2026. The Debian tracker points to advisories DLA-4606-1, DLA-4607-1, DSA-6295-1 and DSA-6306-1.
For PAN-OS, some fixed versions were still on the way, with estimated dates of October 29 and 30. In the meantime, Palo Alto advises moving management traffic off a dataplane port, replacing the certificate, decrypting inbound traffic and enabling threat prevention. CISA set October 31, 2026 as the deadline for federal agencies, according to The Hacker News.
Limits to know
- CISA has not released details about the ongoing attacks.
- The attribution to a China-linked group is a suspicion from Dream.
- The firewall vendor involved is not confirmed by Dream.
- We do not know how many Italian installations are exposed.
- The sources do not list the correct kernel versions for each distribution.
What changes for people working in digital
If you run a PHP site on your own server, you can no longer treat the kernel and PHP as two separate problems. Code execution on the web, normally contained, becomes full control if the kernel is outdated.
If you manage servers, work on SSH security remains useful but is not enough, because the entry point here is the web. Services running as daemons also need checking, as explained in our guide to managing Linux processes. If you would rather not handle this yourself, you can rely on a hosting plan with managed security updates.
For PHP developers, the version in use also matters. The modern style of the language, as in PHP 8 attributes, still assumes supported, up-to-date branches.
Our take
This episode exposes a weakness in how many small servers are managed. PHP gets updated when there is time, and the kernel almost never, because it requires a reboot. Attackers are counting on exactly that.
It is worth noting that the sources are partly indirect. Dream is a company that sells security, and its account should be read with that in mind. The solid fact, however, is the addition to the KEV catalog, which signals real exploitation. TechCrunch reports that PHP underpins about 70% of websites and that researchers expect more flaws to be found quickly thanks to AI. The topic connects to the debate on AI, but the advice here is simple. Occasional manual patching no longer works.
Frequently asked questions
Can Fragnesia be exploited remotely?
No, on its own it requires local access. It becomes dangerous when chained with PHP2Shell, which allows remote code execution without authentication.
Which kernels are vulnerable?
Those released before May 13, 2026, according to BleepingComputer. Check your distribution's advisory for the correct package.
Which PHP versions fix PHP2Shell?
8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on October 21, 2026. Earlier versions of each branch should be considered exposed.
Is updating PHP enough?
No, updating PHP closes the entry point but not the kernel flaw. It is best to fix both, because other local access routes remain possible.
Are Palo Alto firewalls at risk too?
Yes, if the management interface is reachable from the internet and the PAN-OS version is not patched. The company recommends restricting access to trusted internal addresses.
What to watch in the coming months, between patches and exposed surfaces
In the coming weeks, the pending PAN-OS fixes and any details CISA may add will matter. Three practical tips.
- Update PHP to a fixed version and restart the services.
- Install the updated kernel from your distribution and reboot.
- Close management interfaces to the internet and look for webshells in web folders.
