CISA gives agencies three days to fix Linux flaw chained with PHP2Shell to hack firewalls

What happened

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-46300, a Linux kernel flaw known as Fragnesia, to its Known Exploited Vulnerabilities (KEV) catalog on October 28, 2026. The KEV catalog lists flaws that attackers are known to use. CISA said in its alert that it added the flaw based on evidence of active exploitation.

CISA's catalog entry says Fragnesia can be chained with CVE-2026-109618 and CVE-2026-109619, two flaws in the PHP programming language known together as PHP2Shell, to plant PHP web shells and run commands as root. A web shell is a small script that gives attackers remote control of a server. Root is the account with full control of a Linux system.

The catalog sets a deadline of October 31, 2026 for U.S. federal civilian agencies to fix Fragnesia. The same alert added CVE-2026-41709, a flaw in Broadcom VMware ESX that CISA said could let someone with administrator access perform certain operations without logging them.

The attack Dream uncovered

Dream, an Israeli security company, reported that its researchers found the artifacts of the operation on October 25. According to Dream, the attacker combined PHP2Shell with Fragnesia to gain root access to 25 servers across the United States, Japan, Taiwan, and South Korea.

The affected devices run specific versions of a large vendor's firewall software, Dream said. It did not name the vendor or the affected versions for security reasons and said it had notified the vendor. Dream said the recovered exploit was a custom build, not a copy of any known public exploit for PHP2Shell, and that the chain gave root access without any login.

The attacker used FOFA, a Chinese internet search engine for finding devices, to identify about 19,000 internet-facing firewalls from the vendor, SecurityWeek reported, citing Dream. After filtering by country and software version, the attacker had 240 targets and exploited 25 firewalls on October 23 and 24.

On 22 of the rooted firewalls, the attacker did nothing beyond planting a web shell, according to Dream. Two firewalls belonged to a U.S. government-affiliated organization. From the second of those, the attacker built a tunnel into the internal network and used the same chain against a third server, the organization's internal firewall management server.

From there, Dream said, the attacker turned to Active Directory, the organization's identity infrastructure. The recovered artifacts confirm credential extraction and directory enumeration, The Hacker News reported. The attacker also tried passwords themed on the organization against every user account and attempted to create backdoor accounts.

Attribution and what is unknown

Dream does not attribute the activity to a named threat actor but said multiple indicators point to what it called a Chinese-nexus operation. It cited the choice of target countries, Chinese tools, and Chinese-language prompts in the attacker's logs.

Dream found Claude Code installed in the attack infrastructure and an AI-powered offensive security platform called AIScan configured with the Chinese language models DeepSeek and Kimi. Dream said it has no direct evidence that the AI tools were used to write the exploit, and that the operation does not appear to be a fully autonomous nation-state attack.

Whether the password attempts found valid credentials or the backdoor accounts were created is not known. Dream said the results were not among the artifacts it recovered, so it cannot determine the full extent of the compromise.

Background

The PHP security team patched the PHP2Shell flaws on October 21, 2026, according to BleepingComputer. CISA says they allow remote code execution without logging in and affect all PHP installations serving web requests. CISA added both flaws to the KEV catalog on October 26, with a federal deadline of October 29.

Researcher William Bowling publicly disclosed Fragnesia on May 13, 2026, together with a proof-of-concept exploit and a kernel patch, according to Tenable. Tenable said any local user on a system running a vulnerable kernel can exploit it to gain root access. Bowling said the flaw affects all Linux kernels released before May 13, 2026, BleepingComputer reported.

What organizations should do

CISA's PHP alert urges organizations to update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, prioritizing internet-facing systems. CISA notes that PHP is often a component of other software, so organizations should inventory every system running it. CISA said organizations that cannot update right away, or that still run PHP 8.1 or earlier, should take those systems offline until they can be patched or updated.

CISA also advises monitoring for suspicious activity, including PHP worker processes launching shells or downloading tools. For Fragnesia, BleepingComputer reported advice for Linux users to apply kernel updates for their environment as soon as possible.

Dream recommends that organizations rapidly deploy relevant patches and follow their vendor's guidance. It said the attack started with a request to a management interface that should never have been exposed to the internet.