Fragnesia + PHP2Shell: How Attackers Are Chaining CVEs to Root Government Servers
In late October 2026, CISA issued an urgent warning after threat actors were observed chaining two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell) with a high-severity Linux kernel privilege escalation flaw (CVE-2026-46300, dubbed Fragnesia) to implant webshells and execute commands as root. Dream Security researchers documented a campaign that successfully compromised 25 servers across the US, Japan, Taiwan, and South Korea—including three in a US government-affiliated environment—using approximately 40 custom post-exploitation scripts. CISA added both vulnerability sets to its KEV Catalog and mandated patching deadlines for FCEB agencies under BOD 26-04. This exploit chain reflects a growing attacker playbook: combine an internet-facing application flaw for initial access with a local privilege escalation to achieve full root control. The campaign underscores how rapidly threat actors weaponize chained CVEs once proof-of-concept code is publicly available, compressing the window between disclosure and active exploitation to days.
Kill Chain
