CISA lists PHP2Shell as exploited, adds Linux flaw chained for root

The US Cybersecurity and Infrastructure Security Agency (CISA) on October 28 added Fragnesia, a Linux kernel flaw, CVE-2026-46300, to its Known Exploited Vulnerabilities catalog, saying it can be chained with the two PHP flaws known as PHP2Shell to plant web shells and run commands as root. CISA had listed the PHP flaws, CVE-2026-109618 and CVE-2026-109619, as exploited on October 26, giving federal civilian agencies until October 29 to fix them.

Both PHP flaws let an attacker with no account run code on a web server; fixes have been out since October 21. Patching servers may not be enough: the attack chain security company Dream described hit firewalls whose management software runs PHP 8.0.30, a branch PHP no longer supports.

What PHP2Shell is and who is exposed

In PHP2Shell's first flaw, CVE-2026-109618, running out of memory at the wrong moment leaves request data half set up, and cleanup treats it as valid. In the second, CVE-2026-109619, state from one request outlives its memory, and a later request on the same worker uses it. Both are rated 9.2 of 10 (CVSS 4.0).

PHP's advisory puts every installation that serves web requests at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates mod_php highest, because an unauthenticated request can trigger the attack there before any application code runs. On FPM, PHP's technical advisories say code execution has been shown only through paths that depend on the application. PHP 8.1 and older are unsupported, though PHP posted minimal source patches for 7.4 to 8.1.

The PHP Foundation said a developer spotted the first signs of the memory problem in 2024, but a fix stalled for months over hard trade-offs. “We won't pretend otherwise: the delay was a structural failure,” it wrote, and said it has since added staff and started changing how its security team makes decisions.

What CISA's listing requires

Source: CISA's Known Exploited Vulnerabilities catalog, checked October 29.

Under Binding Operational Directive 26-04, a cataloged flaw that gives total control of an internet-facing system must be fixed within three days, with a forensic triage to check whether the system was already compromised. CISA requires that triage for the PHP flaws and Fragnesia. Only federal civilian agencies are bound; CISA urges everyone to use the list.

A listing alone does not confirm a break-in. CISA's criteria count attempted as well as successful exploitation, and its alerts and entries do not say what evidence it relied on.

How it unfolded

• May 13: V12 disclosed Fragnesia.

• August 11: Calif reported a code execution path for the memory bug, the PHP Foundation said.

• October 17: Amazon's honeypots logged an exploitation attempt.

• October 20: The CVE numbers leaked, and PHP moved its release up a day.

• October 21: PHP released the fixes, and CISA urged immediate patching.

• October 24: A researcher's honeypots recorded 35 shells.

• October 25: Palo Alto Networks' Unit 42 retracted a report tying a European government intrusion to PHP2Shell.

• October 26 to 28: CISA added the flaws above.

What the attacks look like

Amazon said the October 17 attempt, four days before disclosure, came from an anonymization network, that it was unclear how the attacker had the details, and that broad exploitation attempts followed the fixes. Amazon's security chief drew the lesson:

With PHP2Shell, compromise may predate the advisory.CJ Moses, CISO of Amazon Integrated Security, October 21, 2026

Wiz called security engineer Adel Karimi's packet captures and process logs “the most robust public evidence we have seen to date”: 35 shells started by Apache workers on three of his honeypots. They ran PHP 8.4.26 under single-worker mod_php, a setup Wiz called favorable, and the traffic was consistent with CVE-2026-109618 and a public exploit. Wiz said on October 27 that its own data showed a limited number of attempts and no complete exploitation.

How Fragnesia turns a web shell into root

Fragnesia is a bug in the kernel's IPsec code that lets an ordinary local user overwrite cached copies of read-only files and get a root shell. Red Hat rates it Important, not Critical, because an attacker first needs access to the machine. PHP2Shell supplies that: code running as the web server's account.

Dream said artifacts it found on October 25 show an attacker firing a custom PHP2Shell exploit and Fragnesia in a single request at an unnamed large vendor's firewalls. The attacker's logs, Dream said, show 24 of 240 targeted firewalls taken over, then a management server reached through one, for 25. Three belonged to a US government-affiliated organization, whose Active Directory became the next target.

CISA does not tie the Brotli flaw, which BleepingComputer calls Node2Shell, to these attacks, but PHP rebuilt its Windows packages, which bundle Brotli, with the fixed version on October 26.

What to do

• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's patched package.

• If you can't yet, PHP's stopgaps reduce but don't remove the risk: enforce memory_limit=-1 in server or pool configuration, keep post_max_size at 8M (32M if you accept uploads), set session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0, then restart every worker.

• Hiding errors doesn't help: PHP says turning off display_errors, changing error_reporting or using @ does not protect against CVE-2026-109619.

• Keep session.upload_progress.enabled=0 after updating, until PHP fixes a related, unlikely attack path, CVE-2026-115560, in its next regular release.

• Find PHP inside other products. CISA says systems on PHP 8.1 or older, or that can't be updated, should go offline until fixed.

• Investigate from October 17, as Amazon advises. Signs include PHP workers starting shells or downloading tools, per CISA, and POST requests containing PHP_SESSION_UPLOAD_PROGRESS, per Amazon.

• Update the kernel. Fragnesia is fixed in Linux 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1. Until then, Ubuntu advises blocking the esp4 and esp6 modules, which breaks IPsec VPNs on that machine.