{"id":10223,"date":"2026-10-30T00:55:47","date_gmt":"2026-10-30T00:55:47","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10223"},"modified":"2026-10-30T00:55:47","modified_gmt":"2026-10-30T00:55:47","slug":"php2shell-plus-fragnesia-a-dangerous-new-route-from-web-server-to-root","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10223","title":{"rendered":"PHP2Shell plus Fragnesia: A dangerous new route from web server to root"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

The PHP2Shell saga continues, with attackers discovering new ways to exploit the critical vulnerability impacting millions of organizations worldwide.<\/p>\n

The US Cybersecurity and Infrastructure Security Agency (CISA) has warned of a high severity Linux kernel privilege escalation flaw that attackers are chaining with PHP2Shell bugs in the wild.<\/p>\n

Identified as CVE-2026-46300<\/a>, it could allow attackers to run malicious code with root permissions, giving them unrestricted ability to run commands, tamper with system settings, view, edit, or delete files, and perform other malicious actions.<\/p>\n

Once attackers establish root access, they can perform any action on a server including, but not limited to, disabling the server, creating accounts, removing accounts, connecting to other servers, and adding\/removing software, explained Scott Miserendino<\/a>, CTO at security and compliance platform DataBee.<\/p>\n

\u201cPHP2Shell allows for remote access, but that access is typically limited by the account used to run the PHP service,\u201d he said. \u201cBy chaining with CVE-2026-46300, that attacker can get unlimited access.\u201d<\/p>\n

Researchers at Dream Security have discovered that this attack has already been used<\/a> to breach 25 servers, including three affiliated with the US government.<\/p>\n

Federal agencies have been ordered to patch the flaw, which is known as Fragnesia<\/a>.<\/p>\n

Anatomy of an attack<\/h2>\n

PHP is a widely-used, open source server-side scripting language that serves as the backbone<\/a> for websites like WordPress, which powers 43% of the web<\/a>, as well as Mailchimp, Drupal, parts of Slack and Zoom, and numerous others.<\/p>\n

Last week, the PHP Foundation disclosed two flaws<\/a> in the PHP scripting language that could allow attackers to perform unauthenticated remote code execution (RCE). CVE-2026-109618<\/a> and CVE-2026-109619<\/a> are both rated a critical 9.2 in severity on the common vulnerability and scoring system (CVSS). The two vulnerabilities are collectively tracked as PHP2Shell. As a result of the disclosure, some government and enterprise websites shut down entirely while awaiting patches.<\/p>\n

CVE-2026-46300<\/a>, dubbed Fragnesia, is a new development in the saga. It is identified as part of the Dirty Frag vulnerability class, a set of local privilege escalation (LPE) bugs in the Linux kernel.<\/p>\n

The Dream researchers described an attack they tracked in the wild, in which threat actors built a persistent tunnel into an internal network \u201cwithin hours.\u201d They developed two distinct exploits, stringing them together to target any Palo Alto Network firewall running a vulnerable build of PAN-OS, and achieved root access in a single HTTP request without any credentials.<\/p>\n

After rooting the firewalls, the threat actor launched attacks against Active Directory (AD), giving them the ability to extract credentials and discover hidden files, folders, and other sensitive resources, according to the Dream researchers. The researchers confirmed that the threat actor then possessed a full AD user group listing and \u201ccomplete organizational blueprint,\u201d private keys and complete network topology, including the IP, hostname, server role, and VPN gateway, and had accessed decrypted service account credentials allowing direct AD queries at any time.<\/p>\n

The adversarial actor also parked nearly two dozen firewalls across the US, Japan, Taiwan, and South Korea, \u201cready for exploitation at any time.\u201d The Dream researchers noted that the breach did not appear to be a fully autonomous<\/a> nation-state attack, but did include some AI-assisted tooling like Claude Code and AI-powered offensive security platforms configured with Chinese large language models (LLMs) DeepSeek and Kimi.<\/p>\n

\u201cThe operation illustrates how an exposed management interface can become a path into an organization\u2019s identity infrastructure,\u201d the Dream researchers wrote.<\/p>\n

Plenty of material for attackers to work with<\/h2>\n

The two PHP bugs<\/a> gave an attacker code execution privileges using the web service account, and the kernel bug is what turned that into root, explained Aaron Beardslee<\/a>, manager of threat research at Securonix, who noted, \u201cThe kernel bug writes its payload into the page cache rather than to disk.\u201d<\/p>\n

Once an attacker has the ability to execute code, the damage they can do depends on the permissions and credentials available to that process, he explained. Application configuration files, database credentials, and access to internal services can provide \u201cplenty of material for an attacker to work with.\u201d They may also be able to execute commands, retrieve additional tooling or establish persistence.<\/p>\n

\u201cWeb servers have an unfortunate habit of knowing more about the rest of the environment than anyone intended,\u201d he pointed out.<\/p>\n

The chain\u2019s post-access sequence, as described by the researchers, was: Root the perimeter host, stand up a reverse Secure Shell (SSH) tunnel to an internal management server, recover a Lightweight Directory Access Protocol (LDAP) service account credential, then \u201cenumerate domain users and groups, spray passwords, and attempt to create backdoor accounts in Active Directory.\u201d<\/p>\n

PHP has \u201cbeen holding up a substantial chunk\u201d of the internet for decades, and these vulnerabilities live in the runtime itself, Beardslee noted. An enterprise\u2019s WordPress installation can be fully patched, plugins can be current, but the underlying PHP process can still be vulnerable to unauthenticated code execution.<\/p>\n

The reported victim count (25 servers so far, mostly firewall appliances, on a government affiliated network) is the part everyone will quote, but it is not the interesting part, he said. Counts differ, and attribution is \u201copenly contested.\u201d None of them is what matters to defenders.<\/p>\n

\u201cWhat matters is that the privilege escalation step in this chain is invisible to disk-based integrity checking,\u201d Beardslee said, \u201cand that the standard remediation advice destroys the evidence of it.\u201d<\/p>\n

Remediation<\/h2>\n

Unfortunately, CVE-2026-46300 is a low-level Linux kernel bug, so the only remedy is to upgrade to a patched Linux version, said DataBee\u2019s Miserendino. There are some options short of full patching, but those could break the system, or at a minimum require IPSec encapsulating security payload (ESP) to be disabled. But that can introduce additional flaws.<\/p>\n

\u201cPatch the kernel, and capture memory first on anything you suspect,\u201d Beardslee recommended, noting that the Fragnesia fix is not included in the Dirty Frag patches. \u201cThe triage order matters more here than it usually does, because the reboot is what erases the evidence.\u201d<\/p>\n

As well, audit the core built-in kernel modules esp4<\/em> and esp6<\/em>, which are responsible for handling the IPsec ESP network protocol, on every internet-facing Linux host, he advised. If nothing terminates IPsec there, \u201cthe modules have no business being loaded,\u201d and unloading them removes the vulnerability path without waiting for a maintenance window.<\/p>\n

And check which hosts hold a directory service credential, then alert of LDAP binds from anything that isn\u2019t on that list, he said: \u201cThis is the control that catches the chain at the stage where it stops being a web server problem and starts being a domain problem.\u201d Further, he said, re-point identity detections at \u201cthe source, not the tool.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

The PHP2Shell saga continues, with attackers discovering new ways to exploit the critical vulnerability impacting millions of organizations worldwide. The US Cybersecurity and Infrastructure Security Agency (CISA) has warned of a high severity Linux kernel privilege escalation flaw that attackers are chaining with PHP2Shell bugs in the wild. Identified as CVE-2026-46300, it could allow attackers […]<\/p>\n","protected":false},"author":0,"featured_media":10224,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10223","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10223"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10223"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10223\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10224"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10223"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10223"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10223"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}