CISA Alerts on Critical Linux Kernel Privilege‑Escalation (CVE‑2026‑46300) Chained with PHP2Shell Attacks
What Happened — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a Binding Operational Directive (BOD 26‑04) ordering all Federal Civilian Executive Branch agencies to patch a high‑severity Linux kernel privilege‑escalation bug (CVE‑2026‑46300, dubbed Fragnesia) by Oct 31. Fragnesia is a logic error in the XFRM ESP‑in‑TCP subsystem that lets a local attacker obtain root privileges on any Linux distribution with kernels released before 13 May 2026. CISA also highlighted that threat actors are chaining this kernel flaw with two actively‑exploited PHP vulnerabilities (CVE‑2026‑109618 and CVE‑2026‑109619, collectively known as PHP2Shell) to drop web‑shells and execute commands as root on unpatched web servers. Dream Security reported that the combined exploit chain has already compromised more than two dozen servers worldwide, including three belonging to a U.S. government‑affiliated organization. The agency added both the Linux and PHP flaws to its Known Exploited Vulnerabilities (KEV) catalog and mandated remediation within days.
Why It Matters for Trust & Control Assurance — This incident tests the control objective of timely vulnerability and patch management, a cornerstone of audit‑ready security programs.
Who Is Affected — Federal agencies, cloud‑service providers, SaaS operators, and any organization running Linux kernels < 5.16 (pre‑May 2026) with PHP‑based web applications.
Recommended Actions
- Deploy the kernel patches released by your Linux distribution for CVE‑2026‑46300 immediately.
- Upgrade PHP to a version that mitigates CVE‑2026‑109618/109619 (or apply the vendor’s mitigations).
- Conduct an inventory sweep to confirm all affected assets are patched; document the remediation for audit evidence.
- Enable continuous vulnerability scanning and integrate KEV alerts into your security operations workflow.
Source: BleepingComputer
Technical Notes
- Attack vector: Local privilege escalation via Linux XFRM ESP‑in‑TCP logic bug, chained with remote code execution through vulnerable PHP modules.
- CVEs: CVE‑2026‑46300 (Linux kernel), CVE‑2026‑109618 & CVE‑2026‑109619 (PHP2Shell).
- Data types: No data exfiltration reported; impact is system compromise and potential downstream data access.