CISA Gives Agencies 3 Days to Fix Fragnesia

US federal agencies have until 31 October to patch a Linux kernel flaw that attackers have used to gain root control of internet-facing firewalls, after the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-46300 to its Known Exploited Vulnerabilities catalogue on 28 October. CISA has also flagged the entry for forensic triage, meaning agencies must check whether a system was compromised before the fix went on, not just install it.

The flaw, which researchers have nicknamed Fragnesia, is not new: fixes have been in stable Linux kernels since May. What changed is how it is being used. CISA’s catalogue entry says it “can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root”. Those two are the PHP2Shell flaws that CISA listed as exploited earlier this week.

In brief

CVE-2026-46300 is a local privilege escalation bug in the Linux kernel, rated 7.8 (high) by NIST, and fixed in stable kernels since May.
CISA says it has evidence of active exploitation and has set a 31 October deadline, with forensic checks required.
Security firm Dream says a China-linked actor chained it with PHP2Shell to root 24 firewalls, according to SecurityWeek.

What the kernel flaw does

According to the NIST National Vulnerability Database, the bug sits in how the kernel merges network buffers. When two socket buffers are coalesced, the kernel can drop a marker that says some of the data is shared with the page cache. IPsec (ESP) processing may then decrypt that data in place, which CISA describes as “unintended modification of page-cache-backed data”. The upstream fix is titled “net: skbuff: preserve shared-frag marker during coalescing”.

NIST scores it 7.8 out of 10. The attack vector is local and needs low privileges, so on its own it cannot be triggered from the internet. An attacker first needs a foothold on the machine, which is exactly what PHP2Shell supplies on servers running vulnerable PHP.

NVD lists fixed releases in the 5.10, 5.15, 6.1, 6.6, 6.12 and 6.18 stable branches (5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91 and 6.18.33) and in 7.0.10 and 7.1. Affected code dates back to kernel 3.9. Distributions ship their own builds, and Red Hat errata are among the references NVD links.

How the chain was used, according to Dream

The exploitation details come from Dream, an Israeli security firm. SecurityWeek reported that Dream tracked a China-linked actor that used the FOFA search engine to find about 19,000 internet-facing firewalls from one vendor, then narrowed them to 240 targets in the US, Japan, Taiwan and South Korea running newer PHP versions. Dream says 25 devices were exploited on 23 and 24 October and a root webshell was planted on 24 of them, with no further activity seen on 22.

On two servers in a US government-affiliated environment, Dream says the attackers went further: they opened a reverse SSH tunnel to an internal firewall management server, decrypted an LDAP service account password, tried password spraying and attempted to create backdoor accounts in Active Directory. The Next Web reported that Dream could not determine whether those accounts were created, and that it had not independently verified Dream’s findings. Dream did not name a specific group.

Why a local bug earned a three-day deadline

On paper, CVE-2026-46300 looks like the kind of flaw that waits for a routine patch cycle. It has a local attack vector and had been public for five months. NVD’s record even shows a CISA risk scoring from 16 October that rated exploitation as “none”. Twelve days later, CISA listed it “based on evidence of active exploitation”.

The gap between those two assessments is the lesson. A privilege escalation bug is a second-stage tool, and its danger depends on what gives attackers the first stage. Once PHP2Shell offered a way to run code as the web server user, a kernel flaw that turns that into root became urgent. Root on a firewall is especially valuable, because it sits on the path into internal networks and often holds credentials, as Dream’s account of the LDAP password shows.

The forensic triage flag matters as much as the deadline. CISA’s Binding Operational Directive 26-04, the alert says, “establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied”, and the catalogue marks this flaw as one where that check is required. A webshell planted with root rights can survive an update. Patching a device that was already breached closes the door behind the intruder rather than in front of them.

What defenders should do now

For any organisation running Linux appliances or servers, the order of work follows from the chain CISA describes. First, find exposed devices that run PHP and confirm they are on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, the releases that fix PHP2Shell. Second, move kernels to a fixed stable release or the vendor’s patched build. Third, for anything that was internet-facing and unpatched in late October, look for webshells, unexpected SSH tunnels and new directory accounts before declaring it clean.

The deadline binds only US federal civilian agencies, but CISA “encourages all organizations” to prioritise catalogue entries. In the UK, 32 government services went offline as a precaution after PHP2Shell, and CISA has also listed a Brotli decoder flaw in Node, Bun and Envoy. CISA added one other entry on 28 October, a VMware ESX logging flaw from Broadcom, with a later deadline of 11 November.

The test now is how many appliance vendors ship patched kernels before the 31 October deadline, and whether more victims surface once agencies start their forensic checks.