CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks

CISA has directed federal agencies to remediate a high-severity Linux kernel privilege escalation flaw that is being actively combined with a separate PHP exploit chain in real-world intrusions. The bug, CVE-2026-46300 and nicknamed Fragnesia, resides in the XFRM ESP-in-TCP subsystem of the Linux kernel and allows local attackers to escalate to root, with a public proof-of-concept available against distributions running kernels released before May 13, 2026. CISA placed the flaw on its Known Exploited Vulnerabilities catalog under Binding Operational Directive 26-04, giving agencies until Saturday the 10th to patch, and warned it can be paired with two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, to plant webshells and execute commands with root privileges. Security firm Dream Security reported that this combined attack chain already compromised more than two dozen servers across the US, Japan, Taiwan and South Korea, including three machines tied to a US government-affiliated organization, after discovering target lists, exploitation logs and roughly 40 post-exploitation scripts left behind by the attackers.