CISA warns federal agencies to patch Fragnesia Linux kernel flaw used with PHP attacks
Servers running affected Linux kernels can be taken over as root by attackers who combine the flaw with PHP weaknesses, so patching is the immediate step.
US agency CISA has told federal bodies to fix a high-severity Linux kernel privilege-escalation flaw, CVE-2026-46300 (dubbed Fragnesia), that attackers are combining with two PHP vulnerabilities to plant webshells and run commands as root. The bug sits in the kernel's XFRM ESP-in-TCP code and affects major distributions running kernels released before May 13, 2026, with a public proof-of-concept exploit available. CISA added it to its Known Exploited Vulnerabilities catalogue and set a patch deadline for federal systems. A security firm, Dream Security, reported that the chain was used to compromise about 25 servers across the US, Japan, Taiwan and South Korea, then three servers in a US government-affiliated environment. Separately, CISA listed the PHP flaws as actively exploited, and Perplexity engineer Adel Karimi reported attacks on an Apache mod_php installation running PHP 8.4.26 captured by their honeypots.
Why it matters
The chain matters most to operators of shared or internet-facing Linux servers, since a single compromised PHP application can be turned into full root access on the host. Federal agencies now have a binding patch deadline, and the reported campaign across several countries, including a government-affiliated environment, shows the chain is being used beyond testing. Because a public proof-of-concept exists, unpatched systems running kernels released before May 13, 2026 remain exposed.
Series Critical PHP flaws
- CISA warns federal agencies to patch Fragnesia Linux kernel flaw used with PHP attacks
- PHP2Shell and Fragnesia chain used to root 25 servers, with attacks also hitting PAN-OS management interfaces
- CISA Flags Two Actively Exploited PHP Flaws Allowing Unauthenticated Code Execution
- Critical PHP flaws prompt urgent patching across a large share of the web
- Industrial Vendors Assess Exposure to PHP2Shell Flaws in Their Products
- Two PHP flaws patched after first confirmed in-the-wild attacks
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.