PHP2Shell Plus Fragnesia: CISA Says CVE-2026-46300 Turns a PHP Foothold Into Root

An unauthenticated remote attacker can run code in a PHP worker through CVE-2026-109618 and CVE-2026-109619, and CISA says CVE-2026-46300 in the Linux kernel can turn that foothold into root. Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and patch the kernel separately, because one fix does not cover the other.

CISA's alert on the PHP flaws, which it calls "php2shell," was issued October 21 and revised on October 23 and October 26. It lists every installation serving web requests as affected: Apache with mod_php (rated highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. The alert carries no CVSS score and no description of the kernel chain.

Timeline of the three CVEs

Date (2026)	Event
October 21	CISA publishes its PHP alert; fixed versions available
October 23	Alert updated with a SIGMA detection rule
October 26	CVE-2026-109618 and CVE-2026-109619 added to the Known Exploited Vulnerabilities catalog, due October 29
October 28	CVE-2026-46300 added, due October 31

CSO Online reports that each PHP flaw is rated CVSS 9.2. The score reflects an attacker who needs no credentials and no user interaction. It does not tell you whether your build is reachable, so inventory first: CISA says to include PHP bundled inside other software, and to take systems offline if they run PHP 8.1 or earlier, which no longer receives fixes.

What CVE-2026-46300 adds on the same host

The kernel entry in the KEV catalog describes a missing-initialization bug. A shared-fragment marker is not preserved when socket buffers are coalesced, so ESP input processing decrypts shared fragments in place and can modify data held in the page cache. CISA's entry says it "can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root."

The precondition is local code execution, which the PHP flaws supply. CSO Online, which calls the kernel bug Fragnesia and places it in the Dirty Frag class, quotes Scott Miserendino, CTO of DataBee: PHP2Shell access is normally limited to the PHP service account, but chaining it with CVE-2026-46300 grants unlimited access. He says the only real fix is a patched kernel, and CSO adds that the Fragnesia fix is not included in the Dirty Frag patches.

The detection problem is separate from the patching one. Aaron Beardslee, manager of threat research at Securonix, told CSO the payload lands in the page cache rather than on disk, so disk-based integrity checks cannot see that step, and a reboot erases the evidence. Capture memory before restarting a suspect host.

1. PHP CVE-2026-109618 and -1096193 days
2. Linux kernel CVE-2026-463003 days
3. Ivanti Connect Secure CVE-2026-1113573 days
4. Ivanti Connect Secure CVE-2026-11852714 days

Source: CISA Known Exploited Vulnerabilities catalog JSON, accessed 2026-11-06

One report of the chain in use, with caveats

CSO Online relays a report from Dream Security that attackers used the combination against 25 servers, three of them tied to the US government and most of them firewall appliances, and that they chained two exploits against Palo Alto Networks firewalls running a vulnerable PAN-OS build. The same report says Claude Code and offensive tools configured with DeepSeek and Kimi models assisted the operation. CSO states the victim count is contested and attribution "openly contested," and the figures have not been independently verified. Treat them as one vendor's claim.

Three days is not unusual this month: the Ivanti Connect Secure listings we covered carried one 3-day and one 14-day window, and the Cisco ASA flaw was listed a day after the kernel bug.

What to do this week

Upgrade PHP on every web-facing host, then the kernel. On internet-facing Linux hosts with no IPsec, CSO's sources advise unloading the esp4 and esp6 modules, with the caveat that disabling ESP can break other things. List the hosts that hold directory credentials and alert on LDAP binds from any machine not on that list. The federal due dates have passed; private networks have no such deadline, which is the reason to move now.