Bleepingcomputer CISA Warns of Fragnesia Linux Flaw Exploited in PHP2Shell Attacks
Article Content
- •CISA warns of the Fragnesia Linux kernel flaw (CVE-2026-46300) being exploited with PHP2Shell.
- •Over 25 servers have been compromised, including three in a U.S. government-affiliated environment.
- •Federal agencies must patch their systems by October 10, 2026, as mandated by CISA.
CISA has issued a warning regarding a high-severity Linux kernel vulnerability, CVE-2026-46300, known as Fragnesia, which is being exploited in conjunction with PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). This flaw allows attackers to escalate privileges and run malicious code with root permissions on affected Linux systems. The vulnerabilities have reportedly been used to compromise over 25 servers, including three linked to an U.S. CISA has mandated that federal agencies patch their systems by October 10, 2026, as part of its Binding Operational Directive. The PHP2Shell vulnerabilities were added to the KEV catalog on October 26, 2026, and have been confirmed to be actively. Dream Security analysts have documented a complete attack operation involving these vulnerabilities, including custom scripts and exploitation logs. CISA has urged immediate action to secure networks against these threats.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which systems are affected?
What should federal agencies do?
Is there confirmed exploitation in the wild?
Continue Reading
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25… 
Chinese Hackers Exploit VMware ESXi Logging Flaw as Zero-Day The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that a low-severity VMware ESXi vulnerability, CVE-2026-41709, is being by the China-linked threat actor Warp Panda. This insufficient logging flaw allows attackers with administrator access to perform operations without being logged…