A Linux root bug hit CISA's exploited list. Attackers paired it with PHP2Shell.

On 28 October CISA added Linux kernel flaw CVE-2026-46300, nicknamed Fragnesia, to its exploited list, with a 31 October deadline for federal agencies. Security firm Dream reports attackers chained it with the two PHP2Shell flaws on 23 and 24 October to get root on firewalls of a US government-affiliated organization.

If you run PHP on Linux, you hold both halves of that chain: one bug gets in, the other makes it root. Dream says the attackers then reached a firewall management server and the configurations and credentials of every firewall the organization managed.

Install your distribution's patched kernel and the PHP2Shell fixes on every Linux host that runs PHP, then look for new webshells in your web folders.