CISA warns Fragnesia is being chained in PHP2Shell attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Linux kernel flaw known as Fragnesia to its Known Exploited Vulnerabilities (KEV) Catalog, warning that attackers are chaining it with PHP2Shell vulnerabilities.

Tracked as CVE-2026-46300, Fragnesia is a logic bug in the Linux XFRM ESP-in-TCP subsystem that can let local attackers run code with root permissions. It belongs to the Dirty Frag vulnerability class. A proof-of-concept exploit can gain root privileges on major Linux distributions running kernels released before May 13, 2026.

CISA added Fragnesia to the catalog on Wednesday and ordered federal agencies to patch affected systems by Saturday 10 under Binding Operational Directive (BOD) 26-04. The agency did not describe the ongoing Fragnesia attacks, but said the flaw can be chained with CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell, to implant PHP webshells and run commands as root.

Dream Security analysts said their Monday report documented a campaign that rooted 25 servers in the United States, Japan, Taiwan, and South Korea. Three of the servers were in a U.S. government-affiliated environment. They described a custom PHP2Shell exploit chain paired with Fragnesia, alongside target lists, exploitation logs, and about 40 post-exploitation scripts.

CISA also added the PHP2Shell flaws to its actively exploited list on Monday, giving Federal Civilian Executive Branch agencies until Thursday to secure their networks. Separately, Perplexity security engineer Adel Karimi reported evidence of exploitation over the weekend: honeypots recorded remote code execution against Apache mod_php running PHP 8.4.26.