PHP2Shell plus Fragnesia: A dangerous new route from web server to root

The PHP2Shell saga continues, with attackers discovering new ways to exploit the critical vulnerability impacting millions of organizations worldwide. The US Cybersecurity and Infrastructure Security Agency (CISA) has warned of a high severity Linux kernel privilege escalation flaw that attackers are chaining with PHP2Shell bugs in the wild. Identified as CVE-2026-46300, it could allow attackers to run malicious code with root permissions, giving them unrestricted ability to run commands, tamper with system settings, view, edit, or delete files, and perform other malicious actions. Once attackers establish root access, they can perform any action on a server including, but not limited to, disabling the server, creating accounts, removing accounts, connecting to other servers, and adding/removing software, explained Scott Miserendino, CTO at security and compliance platform DataBee. “PHP2Shell allows for remote access, but that access is typically limited by the account used to run the PHP service,” he said. “By chaining with CVE-2026-46300, that attacker can get unlimited access.” Researchers at Dream Security have discovered that this attack has already been used to breach 25 servers, including three affiliated with the US government. Federal agencies have been ordered to patch the flaw, which is known as Fragnesia. Anatomy of an attack PHP is a widely-used, open source server-side scripting language that serves as the backbone for websites like WordPress, which powers 43% of the web, as well as Mailchimp, Drupal, parts of Slack and Zoom, and numerous others. Last week, the PHP Foundation disclosed two flaws in the PHP scripting language that could allow attackers to perform unauthenticated remote code execution (RCE). CVE-2026-109618 and CVE-2026-109619 are both rated a critical 9.2 in severity on the common vulnerability and scoring system (CVSS). The two vulnerabilities are collectively tracked as PHP2Shell. As a result of the disclosure, some government and enterprise websites shut down entirely while awaiting patches. CVE-2026-46300, dubbed Fragnesia, is a new development in the saga. It is identified as part of the Dirty Frag vulnerability class, a set of local privilege escalation (LPE) bugs in the Linux kernel. The Dream researchers described an attack they tracked in the wild, in which threat actors built a persistent tunnel into an internal network “within hours.” They developed two distinct exploits, stringing them together to target any Palo Alto Network firewall running a vulnerable build of PAN-OS, and achieved root access in a single HTTP request without any credentials. After rooting the firewalls, the threat actor launched attacks against Active Directory (AD), giving them the ability to extract credentials and discover hidden files, folders, and other sensitive resources, according to the Dream researchers. The researchers confirmed that the threat actor then possessed a full AD user group listing and “complete organizational blueprint,” private keys and complete network topology, including the IP, hostname, server role, and VPN gateway, and had accessed decrypted service account credentials allowing direct AD queries at any time. The adversarial actor also parked nearly two dozen firewalls across the US, Japan, Taiwan, and South Korea, “ready for exploitation at any time.” The Dream researchers noted that the breach did not appear to be a fully autonomous nation-state attack, but did include some AI-assisted tooling like Claude Code and AI-powered offensive security platforms configured with Chinese large language models (LLMs) DeepSeek and Kimi. “The operation illustrates how an exposed management interface can become a path into an organization’s identity infrastructure,” the Dream researchers wrote. Plenty of material for attackers to work with The two PHP bugs gave an attacker code execution privileges using the web service account, and the kernel bug is what turned that into root, explained Aaron Beardslee, manager of threat research at Securonix, who noted, “The kernel bug writes its payload into the page cache rather than to disk.” Once an attacker has the ability to execute code, the damage they can do depends on the permissions and credentials available to that process, he explained. Application configuration files, database credentials, and access to internal services can provide “plenty of material for an attacker to work with.” They may also be able to execute commands, retrieve additional tooling or establish persistence. “Web servers have an unfortunate habit of knowing more about the rest of the environment than anyone intended,” he pointed out. The chain’s post-access sequence, as described by the researchers, was: Root the perimeter host, stand up a reverse Secure Shell (SSH) tunnel to an internal management server, recover a Lightweight Directory Access Protocol (LDAP) service account credential, then “enumerate domain users and groups, spray passwords, and attempt to create backdoor accounts in Active Directory.” PHP has “been holding up a substantial chunk” of the internet for decades, and these vulnerabilities live in the runtime itself, Beardslee noted. An enterprise’s WordPress installation can be fully patched, plugins can be current, but the underlying PHP process can still be vulnerable to unauthenticated code execution. The reported victim count (25 servers so far, mostly firewall appliances, on a government affiliated network) is the part everyone will quote, but it is not the interesting part, he said. Counts differ, and attribution is “openly contested.” None of them is what matters to defenders. “What matters is that the privilege escalation step in this chain is invisible to disk-based integrity checking,” Beardslee said, “and that the standard remediation advice destroys the evidence of it.” Remediation Unfortunately, CVE-2026-46300 is a low-level Linux kernel bug, so the only remedy is to upgrade to a patched Linux version, said DataBee’s Miserendino. There are some options short of full patching, but those could break the system, or at a minimum require IPSec encapsulating security payload (ESP) to be disabled. But that can introduce additional flaws. “Patch the kernel, and capture memory first on anything you suspect,” Beardslee recommended, noting that the Fragnesia fix is not included in the Dirty Frag patches. “The triage order matters more here than it usually does, because the reboot is what erases the evidence.” As well, audit the core built-in kernel modules esp4 and esp6, which are responsible for handling the IPsec ESP network protocol, on every internet-facing Linux host, he advised. If nothing terminates IPsec there, “the modules have no business being loaded,” and unloading them removes the vulnerability path without waiting for a maintenance window. And check which hosts hold a directory service credential, then alert of LDAP binds from anything that isn’t on that list, he said: “This is the control that catches the chain at the stage where it stops being a web server problem and starts being a domain problem.” Further, he said, re-point identity detections at “the source, not the tool.”