Fragnesia (CVE-2026-46300)Chained with PHP2Shell in Active Root-Access Attacks

Attackers are chaining two kinds of flaw to take full control of internet-facing servers in a single
unauthenticated request. First, the PHP2Shell flaws let them run code on a server with no login. Then
Fragnesia, a Linux kernel flaw, lets that code become root by rewriting a system file in memory so that
switching to the root account no longer needs a password. Security firm Dream Research found an
apparently Chinese, AI-assisted operation that used this chain to root 25 exposed Palo Alto PAN-OS
devices across the US, Japan, Taiwan and South Korea, then pivoted into a US government-affiliated
Active Directory. CISA has added both flaws to its Known Exploited Vulnerabilities catalogue. Patching
the kernel and PHP, and keeping management interfaces off the internet, are the fixes.

1. Vulnerability Details

The two flaws are chained into a single unauthenticated HTTPS request. PHP2Shell gives code execution as the
SELinux-confined nobody user on the exploited surface, which here is the PAN-OS management web server (appweb,
running PHP 8.0.30) that also fronts the GlobalProtect portal. Fragnesia then escalates to root by overwriting
/etc/pam.d/su in the page cache with a permit-all rule, so su root needs no password, bypassing the SELinux
confinement. The full chain, from unauthenticated connection to a persistent root webshell, completes in under 15
minutes. The on-disk binary and PAM file are untouched, as only the page cache is modified.

• CVE-2026-46300, Fragnesia (CVSS 7.8): A logic bug in the Linux kernel XFRM ESP-in-TCP subsystem, in the Dirty Frag class, where a shared-fragment marker is lost during skb coalescing so ESP decrypts in place over page-cache backed pages. This gives an arbitrary byte write into the page cache of a read-only file with no race. The exploit overwrites /etc/pam.d/su so that su to root succeeds with no password. It affects Linux kernels without the 13 May 2026 fix.
• CVE-2026-109618 and CVE-2026-109619, PHP2Shell (CVSS 9.2): Unauthenticated remote code execution in PHP through memory corruption. The recovered build is a custom, non-public exploit tailored to Palo Alto PAN-OS, driving PHP’s session.upload_progress in four stages (memory exhaustion, information leak of the libphp.so base, stale reference setup, forged HashTable destructor calling system()) to run commands as the nobody user.

2. Affected Products

• Linux kernel (Fragnesia): all builds before the 13 May 2026 Dirty Frag fix; fixed for example in Debian bookworm 6.1.174-1, trixie 6.12.90-1 and bullseye 5.10.257-1, and later distro security updates.
• PHP (PHP2Shell): fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with source backports for 7.4, 8.0 and 8.1.
• Palo Alto PAN-OS management web server (appweb): 12.1 and 12.2 branches (PHP 8.0.30) rooted in the wild; 11.1 (PHP 7.4) RCE lab-tested only; Palo Alto is releasing fixed PAN-OS versions.

3. Observed Activity

• CISA KEV listing CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalogue on 28 October 2026 under BOD 26-04, noting it can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. The PHP2Shell CVEs were added to the catalogue the same week.
• Dream Research campaign Dream Research (results independently verified by Palo Alto Unit 42) found an apparently Chinese, AI-assisted operation that used FOFA to find about 19,000 exposed PAN-OS devices, filtered to 240 in the US, Japan, Taiwan and South Korea on vulnerable 12.1 and 12.2 builds, and rooted 25. It planted a 103 byte PHP webshell at /unauth/php/change_password.php, then pivoted from two US government-affiliated firewalls into Active Directory with credential extraction and directory enumeration. Tooling included aiscan, FOFA keys and Claude Code.
• PHP2Shell in-the-wild RCE confirmed Independent honeypots (0x4D31 and Perplexity) recorded confirmed PHP2Shell remote code execution against an Apache mod_php installation running PHP 8.4.26, from source addresses 15.204.59[.]70 and 162.35.99[.]94.

4. Adversary Toolkit

5. Indicators of Compromise (IOCs)

TYPE- INDICATOR-
FILENAME- /unauth/php/change_password.php
IP- 15.204.59[.]70
IP- 162.35.99[.]94

6. Recommendations

• Patch Palo Alto PAN-OS to the fixed releases for the affected 12.1 and 12.2 branches (and others) as Palo Alto publishes them, and apply the PHP fixes for PHP2Shell (8.2.35, 8.3.36, 8.4.27, 8.5.12 or vendor backports); prioritise internet-facing management and GlobalProtect interfaces.
• Patch the Linux kernel to a build after the 13 May 2026 Dirty Frag and Fragnesia fix (for example Debian bookworm 6.1.174-1 or later, trixie 6.12.90-1 or later); federal agencies must meet the CISA BOD 26-04 deadline for CVE-2026-46300.
• Remove PAN-OS management and appweb interfaces from the internet, place GlobalProtect behind access controls, and check every PAN-OS device for the webshell /unauth/php/change_password.php and remove it.
• Where the kernel cannot be patched at once, apply the Dirty Frag mitigation by disabling the esp4, esp6 and rxrpc modules and restricting unprivileged user namespaces, accepting the functional trade-offs.
• If compromise is suspected, assume root and an Active Directory pivot: hunt for su succeeding without a password, /etc/pam.d/su tampering, multipart POSTs with PHP_SESSION_UPLOAD_PROGRESS and oversized PHPSESSID cookies, rebuild the device rather than clean it, and review AD for credential theft and enumeration, rotating affected credentials.
• Monitor for the IOCs. Block the IOCs at their respective controls.

7. Sources

• https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks
• https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers
• https://security-tracker.debian.org/tracker/CVE-2026-46300
• https://github.com/v12-security/pocs/blob/main/fragnesia/README.md
• https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-rce-evidence/README.md

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.