Attackers turned PHP2Shell break-ins into root on 24 firewalls with an old Linux bug. Boot a fixed kernel by Saturday

We flagged PHP2Shell on Tuesday as the PHP bug that hands attackers a shell. A new report shows what one group did next. It paired PHP2Shell with Fragnesia, a Linux kernel bug from May, and turned a low-privileged web process into root on 24 internet-facing firewalls.

CISA added Fragnesia to its exploited list on Wednesday and gave federal agencies until Saturday, October 31, to fix it. That is three days, and CISA also wants them to check for a break-in, not just patch.

PHP2Shell got the attackers in as “nobody.” A five-month-old Linux kernel bug, Fragnesia, made them root on 24 firewalls. CISA wants it fixed by Saturday.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

CISA lists Fragnesia after it finished a PHP2Shell break-in

On October 28 CISA added CVE-2026-46300, the Linux kernel flaw known as Fragnesia, to the Known Exploited Vulnerabilities catalog. The due date for federal civilian agencies is October 31, and the catalog marks it for forensic triage. CISA’s entry says it can be chained with the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, “to implant PHP webshells and run commands as root.”

The chain comes from Dream Research. In a report dated October 26, Dream says an operator it links to China used the FOFA search engine to find about 19,000 internet-facing firewalls from one large vendor, narrowed them to 240 targets in the US, Japan, Taiwan and South Korea, and rooted 24 of them on October 23 and 24 with a single unauthenticated HTTPS request each. A 25th server, the firewall management system of a US government-affiliated organization, fell next, and the attacker moved on to its Active Directory. Dream did not name the vendor.

Fragnesia itself is old news to kernel teams. It was disclosed with a public exploit on May 13, and fixed stable kernels and distribution packages followed within weeks.

Linux servers and appliances that run PHP on an old kernel

Fragnesia is a local bug: it needs code already running on the machine. PHP2Shell, or any web shell, stolen SSH login or compromised build job, supplies that. On the firewalls, PHP ran as nobody and SELinux stopped it from editing system files. Fragnesia went around that by writing into the kernel’s in-memory copy of /etc/pam.d/su so that su root accepted any password.

Two groups are exposed. The first is any Linux server that runs PHP or other internet-facing code on a kernel without the May fix. The second is harder to fix: firewalls, VPNs and storage boxes whose web interface runs PHP on Linux, where you cannot install a kernel yourself and the vendor has to ship firmware. The firewalls Dream describes ran PHP 8.0.30 on their management server.

Boot a fixed kernel, but check memory before the reboot

• Install your distribution’s fixed kernel and reboot into it. Ubuntu fixed it in 7.0.0-22.22 (26.04), 6.17.0-35.35 (25.10), 6.8.0-124.124 (24.04) and 5.15.0-181.191 (22.04). Debian fixed it in 6.12.90-1 (trixie), 6.1.174-1 (bookworm) and 5.10.257-1 (bullseye LTS). Run uname -r afterwards; an installed kernel that has not booted does nothing.
• Do the memory checks under Hunt / verify before you reboot. The change lives in the page cache, so a restart wipes the evidence along with the backdoor.
• If a host cannot reboot yet, block the esp4 and esp6 modules with a modprobe rule, the same stopgap Ubuntu published for Dirty Frag. That turns off IPsec, so do not use it on VPN gateways.
• Ask your firewall, VPN and storage vendors in writing whether their current firmware includes the CVE-2026-46300 fix and the PHP2Shell fix, and take management interfaces off the internet until it does.
• If several of these land on the same team this week, our patch priority checklist helps order them by exposure.

Details

• CVE: CVE-2026-46300 (Fragnesia), Linux kernel, skb_try_coalesce() drops the shared-frag marker so ESP-in-TCP input decrypts in place over page-cache pages (CWE-456). NVD rates it 7.8 (CVSS 3.1, local). Added to CISA KEV October 28, 2026; due October 31, 2026; forensic triage required.
• Chained with: CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), unauthenticated remote code execution in PHP, fixed October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The firewall build in Dream’s report used PHP 8.0.30, a branch PHP no longer patches.
• Fixed kernels: upstream fix f84eca581739 (“net: skbuff: preserve shared-frag marker during coalescing”). Ubuntu 20.04 on its standard 5.4 kernel is listed as not affected; the 5.15 HWE kernel there needs Ubuntu Pro for the fix.
• Campaign timeline (Dream): setup from October 8; first firewall rooted October 23 at 18:14 UTC; the government-affiliated firewall rooted October 24 at 10:09 UTC; its management server reached through a reverse SSH tunnel at 11:35 UTC.

Hunt / verify

• Look for the PAM change Dream found: grep -n pam_permit /etc/pam.d/su /etc/pam.d/su-l. Any hit on a normal system is wrong.
• Compare installed files with the package database: dpkg --verify login util-linux libpam-runtime on Debian and Ubuntu, rpm -V pam util-linux shadow-utils on RHEL-family hosts.
• Compare the cached copy with the disk copy, for example sha256sum /usr/bin/su against dd if=/usr/bin/su iflag=direct bs=4096 status=none | sha256sum. A mismatch means the in-memory file was changed; save a copy and treat the host as rooted.
• On hosts that already rebooted, look for what root leaves on disk: new systemd units, rc.local lines, unfamiliar SSH keys, outbound SSH sessions and small PHP files in web-served folders.

Source: CISA KEV addition, October 28; Dream Research: the PHP2Shell and Fragnesia chain

Sources

• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 28, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• Dream Research: Chained PHP2Shell Exploit Roots 25 Servers
• SecurityWeek: China-Linked Hackers Exploit PHP2Shell to Root Firewalls
• NVD: CVE-2026-46300
• Ubuntu: CVE-2026-46300
• Debian security tracker: CVE-2026-46300
• HOL Guard: Fragnesia CVE-2026-46300 on CISA KEV, check memory then patch

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].