Update: CISA Adds Fragnesia to KEV, and Palo Alto Confirms PHP2Shell Attacks on Its Management Interfaces

Update: This follows PHP2Shell rooting 25 firewalls.

What’s new

CISA added Fragnesia (CVE-2026-46300) to its Known Exploited Vulnerabilities catalog. It’s a logic bug in the Linux XFRM ESP-in-TCP code that gives a local attacker root on kernels released before May 13, 2026. A public proof of concept exists. CISA says it can be chained with the PHP2Shell bugs (CVE-2026-109618 and CVE-2026-109619) to drop PHP webshells and run commands as root. Federal agencies have a deadline to patch.

Palo Alto Networks also updated its advisory: attackers are exploiting PHP2Shell against internet-exposed management interfaces. The timing lines up with the “large vendor” Dream didn’t name, though nobody has confirmed the link.

What to do

• Take firewall and appliance management off the internet. Today.
• Apply vendor firmware as it lands, and patch Linux kernels for Fragnesia.
• If a management UI was exposed, check for webshells and odd Active Directory activity.

God Bless, and Needs Garlic!

References & Further Reading

• CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks (BleepingComputer)
• Attackers Exploit PHP2Shell Flaws in Palo Alto Networks Management Interfaces (The Hacker News)
• PHP2Shell Rooted 25 Firewalls (EtherNinja)