Fragnesia: the Linux flaw that worsens PHP attacks

CISA confirmed that attackers chain the PHP2Shell flaws with Fragnesia, a Linux kernel vulnerability, to gain full control of servers and firewalls. What to update and how to check.

Attacks against web servers using the PHP2Shell flaws have taken another step. On October 28, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added Fragnesia (CVE-2026-46300), a Linux kernel flaw, to its catalog of exploited vulnerabilities, and warned that attackers chain it with PHP2Shell to plant PHP backdoors (web shells) and run commands as root, the user with full control of the server.

What Fragnesia is

It is a privilege escalation flaw in the Linux kernel's XFRM ESP-in-TCP subsystem, with a severity of 7.8 out of 10 according to NVD, the official US vulnerability database. It lets an unprivileged user modify, in memory, system files that should be read-only, such as the /usr/bin/su program, and become root. It was disclosed on May 13, 2026, with a proposed kernel patch, and public attack code has been available ever since.

Why it worsens PHP attacks

With PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the attacker runs code on the server, but only with the limited permissions of the web service. Fragnesia worsens the damage: from that initial access the attacker becomes root and can erase traces, install programs or jump to other machines on the network. The firm Dream documented a campaign that took full control of 25 devices in the United States, Japan, Taiwan and South Korea using about 40 custom scripts: Palo Alto Networks firewalls running PAN-OS and a firewall management server, attacked through their management interface.

Who is exposed

Any Linux server running a kernel without the May fix. Fragnesia is a separate flaw from Dirty Frag, another one from the same family, and has its own patch: having fixed Dirty Frag is not enough. Red Hat and AlmaLinux released fixed kernels in May; for Ubuntu, Debian and other distributions, check their security advisories.

What to do

Confirm that PHP is on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later version.
If you have Palo Alto Networks firewalls or Panorama, apply the fixed PAN-OS versions listed in the vendor's advisory and do not leave the management interface exposed to the internet.
Update the kernel from your distribution's repositories and reboot the server: the new kernel only takes effect after the reboot, unless you use live patching such as KernelCare.
If you cannot reboot yet, unload and block the esp4, esp6 and rxrpc modules. This is a temporary measure; do not apply it if the server uses an IPsec VPN.
Look for unknown PHP files, new users and scheduled tasks that nobody created since October 20.

For the details of the PHP flaws and their fixed versions, read our PHP2Shell article, which we keep updating as the attacks evolve.

October 31 update: Palo Alto firewalls

We checked this article against Dream's original report: the 25 compromised devices were Palo Alto Networks firewalls running PAN-OS and a management server, not ordinary web servers. Palo Alto published an advisory with the PAN-OS versions that fix the impact of PHP2Shell on its products, so if you have these devices, update them and restrict access to their management interface.

How we help you

With Pronetsys IT infrastructure management we apply operating system and PHP patches, schedule reboots at low-impact times and check servers for traces of attacks. If you run your own Linux server and need support, write to us.