CISA flags critical Linux kernel flaw exploited alongside PHP vulnerabilities in active attacks

The U.S. Cybersecurity and Infrastructure Security Agency has alerted federal agencies to address a high-severity Linux kernel vulnerability being weaponized in conjunction with critical PHP flaws. Designated CVE-2026-46300 and named Fragnesia, the flaw originates from a logic error within the Linux XFRM ESP-in-TCP subsystem, enabling attackers to execute code with root-level access.

Fragnesia falls within the Dirty Frag vulnerability category and includes a working proof-of-concept exploit that local attackers can leverage to obtain root access on mainstream Linux distributions running kernels released before May 13, 2026. CISA entered CVE-2026-46300 into its Known Exploited Vulnerabilities catalog on Wednesday, issuing a directive requiring federal agencies to apply patches by Saturday the 10th under Binding Operational Directive 26-04.

While CISA has not disclosed specifics regarding current Fragnesia exploitation campaigns, the agency indicated that adversaries are combining this flaw with two critical PHP vulnerabilities—CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell—to install webshells and gain command execution on unpatched infrastructure. According to CISA, "This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root."

Fragnesia and PHP2Shell exploit chain

Although CISA has not elaborated on how attackers are chaining these vulnerabilities together, researchers at Dream Security documented in a Monday report that the combined flaws were deployed to compromise over two dozen servers, including three operated by a U.S. government-affiliated entity. The researchers stated that "Dream researchers identified a complete attack operation that included a custom weaponization of the PHP2Shell exploit chain (CVE-2026-109618/CVE-2026-109619) paired with the Fragnesia kernel privilege escalation (CVE-2026-46300), target lists, exploitation logs, and approximately 40 custom post-exploitation scripts."

The campaign evidence showed compromised infrastructure spanning the United States, Japan, Taiwan, and South Korea, with 25 rooted servers identified across these regions. The attackers subsequently focused their efforts on three particular servers within a U.S. government-affiliated network.

CISA added PHP2Shell to its catalog of actively exploited vulnerabilities on Monday, requiring Federal Civilian Executive Branch agencies to secure their systems by Thursday. While the agency has not released additional details on PHP2Shell exploitation in the field, Adel Karimi, a security engineer at Perplexity, confirmed active exploitation over the weekend after their monitoring systems detected remote code execution attempts targeting an Apache mod_php setup running PHP 8.4.26.

A CISA representative was unable to provide supplementary information regarding potential chaining of Fragnesia and PHP2Shell in active attacks when contacted by BleepingComputer earlier in the day.