HighCVE
CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
BleepingComputer·Source published ·1 min read
What happened?
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild. [...]
Key details
- CISA warns federal agencies to patch a high-severity Linux kernel privilege escalation bug actively exploited in the wild.
- Fragnesia affects major Linux distributions with kernels released before May 13, 2026, and has a public proof-of-concept exploit.
- CISA added Fragnesia to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to patch by Saturday 10 under BOD 26-04.
- CISA also added the PHP2Shell flaws to its actively exploited list and mandated FCEB agencies to secure networks by Thursday.
Affected
- Linux kernels released before May 13, 2026 on major distributions.
What to look for
- Custom weaponization of PHP2Shell exploit chain paired with Fragnesia kernel privilege escalation.
- Approximately 40 custom post-exploitation scripts used after initial compromise.
- Remote code execution against Apache mod_php running PHP 8.4.26 observed in honeypots.
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.