Fragnesia Added to CISA KEV: Reboot for Patch Erases Attack Evidence

CISA added Fragnesia (CVE-2026-46300) to its Known Exploited Vulnerabilities catalog on October 28, 2026, warning it is chained with PHP2Shell to gain root on Linux servers. Dream Security documented 25 compromised servers across four countries, with conflicting reports on two or three U.S. government-affiliated targets.

Editor's note: Operational details of the 25-server campaign come from a single Dream Security report, not yet independently replicated. CISA verified in-the-wild exploitation for Fragnesia in the KEV catalog but has not confirmed the specific campaign details. Technical analyses on memory and forensic triage are attributed to the cited experts.

CISA added CVE-2026-46300, known as Fragnesia, to the Known Exploited Vulnerabilities catalog on October 28, 2026. The federal agency warns that the Linux kernel privilege-escalation flaw is chained with two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, collectively PHP2Shell) to move from a web entry point to a root shell. Dream Security documented a campaign that compromised 25 servers in four countries, with exploitation on October 23–24. Sources diverge on the number of U.S. government targets: Dream cites three systems in a government-affiliated environment, SecurityWeek reports two.

Key Takeaways

CISA cataloged Fragnesia (CVE-2026-46300, CVSS 7.8) in the KEV with an explicit warning of chaining with PHP2Shell (CVE-2026-109618/109619, CVSS 9.2 each) to obtain root on Linux servers.
Dream Security documented 25 compromised servers in the U.S., Japan, Taiwan, and South Korea, with exploitation concentrated on October 23–24, 2026; sources disagree on two or three targets in a U.S. government-affiliated environment.
Attackers used FOFA to identify roughly 19,000 exposed firewalls, narrowing the pool to about 240 potential targets after geographic and PHP version filters.
The Fragnesia mechanism loses the SKBFL_SHARED_FRAG marker during skb_try_coalesce(), allowing in-place writes on kernel structures in page cache.

The Chain That Erases the Boundary Between Web and Kernel

The attack structure is bidirectional: PHP2Shell opens the door, Fragnesia elevates the privilege. CVE-2026-109618 and CVE-2026-109619 each carry CVSS 9.2 and allow unauthenticated remote code execution through the PHP parser. Once web-user access is obtained, attackers trigger CVE-2026-46300 in the Linux kernel's XFRM ESP-in-TCP subsystem. Fragnesia carries CVSS 7.8. No aggregated CVSS score exists for the full chain.

The technical mechanism, documented by William Bowling of Zellic in the original May 2026 discovery, involves the skb_try_coalesce() function losing the SKBFL_SHARED_FRAG marker. This loss permits in-place writes on kernel structures in page cache. The compromise resides in memory, not on disk.

Analysis: File integrity monitoring tools based on filesystem hashes do not detect modifications that remain exclusively in RAM. This characteristic, highlighted by Aaron Beardslee of Securonix, renders the privilege-escalation phase invisible to traditional disk-based checks.

CISA explicitly describes the chaining in the KEV catalog text: "This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root." The agency signals a documented operational chain in-the-wild, not two independent facts.

25 Servers, Two Continents, and a Custom Build Not From Public PoC

Dream Security reconstructed the operation's lifecycle. According to BleepingComputer and confirmed by SecurityWeek, researchers recovered target lists, exploitation logs, and roughly 40 custom post-exploitation scripts. The analyzed PHP2Shell build was custom, not derived from public proof-of-concepts — a detail indicating proprietary development or at least significant adaptation.

Initial reconnaissance leveraged FOFA. Attackers identified roughly 19,000 firewalls from a specific vendor with exposed management interfaces, then filtered to about 240 potential targets through geographic and PHP version criteria. Actual execution hit 25 servers over the weekend of October 23–24.

On the number of U.S. government servers, sources do not agree: Dream reports three systems in a government-affiliated environment, SecurityWeek indicates two. The discrepancy may stem from different definitions of "government-affiliated environment" or subsequent count updates. Dream did not specify the exact nature of this environment nor attribute the campaign to a named Chinese APT group, limiting the qualifier to "suspected China-nexus."

AI in the Logs: Tool, Not Just Artifact

Dream detected traces of AI-assisted tooling in the campaign. According to Tech Insider, researchers found API keys for services such as aiscan, references to DeepSeek and Kimi models, and the installation of Claude Code on compromised systems. The structure and consistency across the roughly 40 recovered scripts suggest AI assisted in code generation.

The finding carries a dual reading. On one hand, it lowers the technical skill threshold required to produce custom operational tools. On the other, the October 23–24 campaign launched two days after the PHP patches released on October 21, 2026 (versions 8.2.35, 8.3.36, 8.4.27, 8.5.12).

Analysis: Whether the two-day gap reflects AI-accelerated post-patch development or pre-patch preparation is not verifiable from the documents consulted. Dream did not provide evidence that closes this uncertainty.

"Patch the kernel, and capture memory first on anything you suspect. The triage order matters more here than it usually does, because the reboot is what erases the evidence."
— Aaron Beardslee, Securonix

What to Do Now

CISA issued Binding Operational Directive 26-04, requiring U.S. federal agencies to apply patches by October 31, 2026. The order specifically addresses remediation of CVE-2026-46300 and the associated PHP vulnerabilities. For organizations outside the federal perimeter, the case raises three operational priorities.

First: update PHP to the October 21, 2026 versions — 8.2.35, 8.3.36, 8.4.27, 8.5.12 — and apply kernel patches for Fragnesia. The chain requires both links; patching only PHP leaves the path open to local escalation.

Second: on suspect systems, capture memory before rebooting. Beardslee's recommendation — "capture memory first on anything you suspect" — is expert advice, not a CISA directive. BOD 26-04 requires "forensic triage" but does not specify detailed operational order.

Third: verify that monitoring tools in use detect memory anomalies, not just disk anomalies. The original source (Beardslee) indicates the compromise is "invisible to disk-based integrity checking." CISA does not list specific products nor prescribe detection technologies.

Italy's CERT-AGID detected 467 potentially vulnerable URLs as of October 26, 2026, down from an initial 650. The figure confirms the attack surface remains significant even after patch release.

Editorial Close

The Fragnesia-PHP2Shell chain does not introduce new vulnerabilities but combines two known ones into a concrete operational path. The news value lies in how CISA recognized this chaining as an in-the-wild threat, and in the detail with which Dream reconstructed a real campaign. Caution remains warranted: the 25-server campaign details come from a single structured source, and some technical inferences — particularly on forensic triage — are expert opinions, not government directives. The boundary between what CISA verified, what Dream reported, and what analysts interpreted must remain visible in the text.

Sources

Sources and references

Get DeafLetter