US cybersecurity agency CISA has added CVE-2026-46300, known as Fragnesia, to its catalogue of actively exploited vulnerabilities, BleepingComputer reports. It is a bug in the Linux kernel's XFRM ESP-in-TCP subsystem that lets a local attacker gain root privileges on major distributions with kernels released before 13 May 2026. CISA warns that it is being chained with the two critical PHP bugs known as PHP2Shell, so attackers can plant webshells and run commands as root. Dream Security reports a campaign that fully took over 25 servers in the US, Japan, Taiwan and South Korea.

What it means: Combining the two flaws turns an attack on a website into a full takeover of the server. PHP2Shell lets the attacker run code with the limited rights of the web service, and Fragnesia lets them climb to administrator rights, where they can hide, steal data from every application and use the machine for further attacks. Most websites and online shops in Greece run on Linux with PHP, often on shared hosting or on servers that are not updated regularly, so exposure is wide. The priority is twofold: upgrade PHP to the fixed versions and update the kernel, which needs a reboot and is therefore often postponed. Anyone who had not updated PHP by the start of the week should check logs and application folders for unfamiliar PHP files. Hosting providers should tell customers when their infrastructure was updated. Organised campaigns emerging within days of disclosure show the margin for delaying updates has practically vanished.

Read the original on BleepingComputer

Related service: Custom software

Related stories