PHP2Shell plus Fragnesia: A dangerous new route from web server to root
Summary
Attackers are chaining a critical PHP vulnerability (PHP2Shell) with a high severity Linux kernel privilege escalation flaw (CVE-2026-46300), dubbed Fragnesia. This combination allows attackers to gain root access on affected servers, enabling them to run malicious code and perform unrestricted actions. Researchers have already observed this attack compromising 25 servers, including some affiliated with the US government.
IFF Assessment
The chaining of two severe vulnerabilities, PHP2Shell and CVE-2026-46300 (Fragnesia), allows attackers to achieve unrestricted root access, posing a significant threat to organizations.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: October 29, 2026. Known ransomware use: Unknown.
Defender Context
Defenders should prioritize patching both the PHP scripting language for PHP2Shell-related vulnerabilities and the Linux kernel for CVE-2026-46300. The chaining of these vulnerabilities highlights the importance of a defense-in-depth strategy, as a compromise in one area can lead to a complete system takeover.