The US Cybersecurity and Infrastructure Security Agency (CISA) added Fragnesia, a Linux kernel flaw tracked as CVE-2026-46300, to its Known Exploited Vulnerabilities catalog on October 28, 2026. CISA said attackers can pair the Fragnesia Linux flaw with the two PHP2Shell bugs (CVE-2026-109618 and CVE-2026-109619) to plant PHP webshells and run commands as root. If your site runs PHP on a Linux server, this is a follow-up to our PHP2Shell exploitation update worth acting on tonight.

What’s new

  • CISA lists CVE-2026-46300 as exploited and gave federal agencies until October 31 to patch it.
  • Fragnesia is a privilege escalation bug in the kernel code that handles ESP-in-TCP traffic. Tenable says it was disclosed with a public proof-of-concept on May 13, 2026, and estimates its CVSS score at 7.8.
  • BleepingComputer reports that Dream Security researchers found a campaign that used PHP2Shell plus Fragnesia to take root control of 25 servers in the US, Japan, Taiwan and South Korea.

On its own, Fragnesia needs a local account on the machine. PHP2Shell supplies that foothold. An attacker who gets code running through PHP can then use the kernel bug to own the whole server, including every other site and mailbox on it.

Who it affects

Owners of VPS, dedicated and cloud servers running Linux with a kernel from before mid-May 2026 and a PHP build that hasn’t been updated for PHP2Shell. Tenable lists fixed kernels for AlmaLinux and Fedora, and listed Red Hat Enterprise Linux, Debian and openSUSE as vulnerable when it published, so check your distribution’s security tracker for the current status. Tenable says Amazon Linux isn’t affected.

Shared hosting and managed WordPress customers don’t control the kernel. Their host does, so the job there is asking the right questions.

Our take

We’re treating this as the push to finish PHP2Shell patching today. Update PHP first, since that closes the way in, then install the kernel update and reboot, or apply a live patch if your host offers one. If a reboot has to wait, Tenable’s stopgap is unloading and blocking the esp4, esp6 and rxrpc kernel modules. On shared hosting, open a ticket and ask which PHP version and kernel your account runs on. Then look for files you didn’t upload in writable folders such as wp-content/uploads.

Our original checklist is in what website owners should check for PHP2Shell. If you would rather hand the patching and monitoring to someone, our website maintenance service covers it, priced after a free audit.