"This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root," CISA said.
CISA's warning, KEV listing, and binding deadline
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-46300 — nicknamed Fragnesia — to its Known Exploited Vulnerabilities (KEV) Catalog and issued a binding order for federal agencies to patch affected systems. CISA placed the vulnerability on the KEV list on Wednesday and, under Binding Operational Directive (BOD) 26-04, ordered agencies to patch by "Saturday 10." CISA also added the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) to its list of actively exploited vulnerabilities and required Federal Civilian Executive Branch (FCEB) agencies to secure their networks by Thursday.
What Fragnesia (CVE-2026-46300) is
Fragnesia is a high-severity Linux kernel privilege escalation vulnerability traced to a logic bug in the Linux XFRM ESP-in-TCP subsystem. The flaw is classified within the Dirty Frag vulnerability family and has a proof-of-concept exploit that a local attacker can use to obtain root privileges on major Linux distributions whose kernels were released before May 13, 2026.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow Fragnesia is being chained with PHP2Shell
CISA warned that attackers are chaining Fragnesia with two critical PHP vulnerabilities — tracked collectively as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) — to install PHP webshells and achieve root command execution. While the agency did not publish technical chaining steps, its advisory was explicit: the combined vulnerabilities enable webshell implantation and running commands as root.
Observed exploitation: Dream Security and Perplexity findings
Independent security researchers reported active abuse consistent with CISA's advisory. Dream Security said it identified a complete attack operation that paired a custom weaponization of the PHP2Shell exploit chain with the Fragnesia kernel privilege escalation. Dream researchers reported artifacts including target lists, exploitation logs, and roughly 40 custom post‑exploitation scripts, and said the campaign had rooted 25 servers across the United States, Japan, Taiwan, and South Korea. The attackers, Dream wrote, then focused on three servers in a US government‑affiliated environment.
Separately, Perplexity security engineer Adel Karimi confirmed in‑the‑wild exploitation over the weekend after honeypots recorded evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26.
What this means for technologists, FCEB agencies, and affected organizations
- Technologists and security teams: Systems running kernels released before May 13, 2026, and web servers running Apache mod_php with PHP 8.4.26 must be evaluated quickly for exposure to the Fragnesia PoC and the PHP2Shell remote‑code execution vulnerabilities; CISA’s advisory links the two as an active exploit chain capable of implanting webshells and achieving root commands.
- FCEB agencies and compliance teams: CISA’s addition of CVE-2026-46300 to the KEV Catalog and the BOD 26-04 deadline impose a near‑term patching requirement — agencies were ordered to patch by "Saturday 10" — and an additional directive to secure networks against PHP2Shell by Thursday.
- Affected enterprises and operators: Dream Security’s report of 25 rooted servers across four countries, including three in a US government‑affiliated environment, underscores that chained exploitation can lead to broad compromise and focused targeting once hosts are rooted.
CISA did not publish technical indicators of active Fragnesia attacks, and the agency stopped short of releasing exploit details while still mandating emergency remediation. The public record assembled by Dream Security and Perplexity, however, shows an operation that combined remote PHP exploitation with a local kernel escalation to achieve persistent, high‑privilege access. Whether federal and private operators can meet the agency’s near‑term deadlines and blunt further spread will be the immediate test — especially in environments where kernels predating May 13, 2026, remain in production and Apache mod_php instances persist.
