Fragnesia Linux Flaw Now Exploited: Patch Kernels and PHP Together

If your business runs websites, firewalls or applications on Linux servers, this one needs attention this week. The US Cybersecurity and Infrastructure Security Agency (CISA) added a Linux kernel flaw known as Fragnesia (CVE-2026-46300) to its Known Exploited Vulnerabilities catalogue on 28 October 2026, warning that it can be chained with the recently patched PHP2Shell flaws to take full root control of a server.

What happened

Fragnesia is a privilege escalation bug in the Linux kernel. On its own it cannot be triggered over the internet: an attacker first needs some foothold on the machine, such as a low-privileged account, a container, or code running through a hacked web application. Once that foothold exists, the flaw lets them become root, the all-powerful administrator account.

CISA’s listing means the agency has evidence of real-world exploitation. US federal civilian agencies were given until 31 October 2026 to fix it. CISA also said the kernel flaw can be combined with two PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell, to plant webshells and run commands as root.

How the attack chain works

1. Break in through PHP. An attacker exploits PHP2Shell on an internet-facing server running an unpatched PHP version. This gives them the ability to run commands as the web server’s user.
2. Climb to root with Fragnesia. From that limited account, they use the kernel flaw to gain root.
3. Dig in. With root, they can install backdoors, steal credentials and move deeper into the network.

Security firm Dream has reported a campaign that used exactly this pairing to root 25 servers, most of them firewalls, and then decrypt a directory service account password. That report has not been independently verified, and some other early claims about PHP2Shell victims have since been withdrawn by the companies that made them, so treat specific attack figures with care. CISA’s own action, however, is official.

Why Fragnesia is dangerous

The bug sits in how the kernel merges network data buffers. Under certain conditions it loses track of whether a piece of memory is shared with a cached file, allowing the IPsec ESP code to decrypt data directly over that file’s in-memory copy. According to Red Hat, a local attacker can use this to write bytes into the cached copy of read-only files, including privileged programs, and so gain root. No user interaction is needed.

The change lives only in memory

Because the tampering happens in the page cache rather than on disk, the file on disk is untouched. That means disk-based integrity checks may not spot it, and rebooting a compromised machine can wipe evidence. The flaw is rated 7.8 (High) on the CVSS scale.

It is not new, but it was ignored

Fragnesia was publicly disclosed on 13 May 2026, with a proof-of-concept exploit, as part of a family of related “Dirty Frag” kernel bugs. Major Linux distributions shipped fixes in May. The risk today is mainly to servers that were never updated or never rebooted into the new kernel, which is common on long-running web servers and appliances.

Who is affected

The bug was introduced in Linux 3.9, so many systems are in scope. Fixed upstream kernels include 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10, plus 7.1. Distribution status reported so far:

• Red Hat Enterprise Linux 8, 9 and 10: fixed in May 2026. RHEL 6 and 7 are not affected.
• Ubuntu 22.04, 24.04, 25.10 and 26.04: fixed.
• Debian 11, 12 and 13: fixed.
• SUSE, openSUSE, Amazon Linux 2 and 2023, and Oracle Linux 7 to 10: fixed.
• Appliances such as firewalls, storage boxes and industrial controllers run their own vendor kernels. They are only fixed when the vendor ships new firmware.

For the PHP half of the chain, the PHP project released fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP has said servers using mod_php face the highest risk. Shared hosting and cPanel-style servers common among Nigerian SMEs often run PHP sites, so website owners should confirm their host has updated.

What you should do

For server administrators

1. Update the kernel and reboot. Installing the package is not enough; the server must boot into the fixed kernel. Check the running version with uname -r.
2. Patch PHP to one of the fixed versions above. Patching PHP does not fix the kernel, and vice versa, so do both.
3. If you cannot reboot yet, distributions suggest blocking the esp4 and esp6 kernel modules, which will break IPsec VPNs, or Red Hat’s alternative of setting user.max_user_namespaces=0, which can break rootless containers and sandboxed apps. Test first.
4. Reduce footholds: disable unneeded SSH access, run web apps as non-root users and keep SELinux or AppArmor enforcing.
5. Ask appliance vendors for their Fragnesia fix status in writing.

If you suspect compromise

• Capture evidence before rebooting, since memory-only changes vanish on restart.
• Look for esp4, esp6 or espintcp modules loaded on servers that do not use IPsec.
• Check for web server or PHP processes spawning shells or calling su, and for unexpected outbound SSH connections from web servers.
• Rotate passwords and keys used on the affected server, especially service accounts.

For business owners without in-house IT

• Ask your hosting provider or IT contractor to confirm, in writing, that your servers run a fixed kernel and patched PHP.
• Make sure you have a recent, offline backup of your website and data.

Fragnesia is a reminder that “patched in May” only protects you if the patch is installed and the machine restarted. Make kernel reboots a routine part of maintenance, not an afterthought.

Sources

• Rescana: Linux Kernel Fragnesia CVE-2026-46300 in CISA KEV
• The Next Web: CISA confirms attackers are exploiting both PHP2Shell flaws
• Tenable: Fragnesia (CVE-2026-46300) FAQ
• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog

Featured image: Photo: "Server rack" by towo™, CC BY-SA 2.0, via Openverse — source