AI Agent UpdateCISA gives agencies 3 days to patch the Linux 'Fragnesia' flaw — as PHP exploitation is confirmed for real
A Linux kernel flaw that chains with the PHP flaws to give attackers full control now has one of the shortest patch fuses of the week — and researchers have just confirmed the PHP flaws themselves are being exploited successfully, not just probed.
The News
The US Cybersecurity and Infrastructure Security Agency, CISA, added a Linux kernel flaw to its Known Exploited Vulnerabilities catalog on October 28, with a federal patch deadline of October 31 — an unusually short fuse of three days. The flaw, CVE-2026-46300, nicknamed Fragnesia, carries a CVSS severity score of 7.8 out of 10 and stems from missing initialisation in socket-buffer coalescing, a piece of low-level networking code in the Linux kernel. The kernel is the core of the operating system; a flaw there can affect everything running on the machine. CISA's catalog is a list of flaws known to be exploited, and federal agencies are required to patch listed flaws by the deadline.
What makes Fragnesia dangerous is what it chains with. Per CISA's description, it combines with the PHP2Shell flaws — CVE-2026-109618 and CVE-2026-109619 in the PHP programming language — to plant PHP webshells and run commands as root. A webshell is a hidden back door on a web server; root is the highest level of access on a Linux machine, able to do anything. In plain terms: the PHP flaws get attackers in as the web-server user, and Fragnesia turns that foothold into full control of the host. Security firm Dream attributed exploitation against 25 internet-facing firewalls on October 23-24 to a suspected China-linked group, with two used to reach a US government-affiliated network. The KEV catalog now holds 1,762 entries.
The second development of the day confirms the PHP half of that chain is no longer theoretical. Researchers at Perplexity recorded the first successful exploitation of the PHP memory-corruption and stale-state flaws in honeypot sensors on October 24, reported publicly on October 28 — confirmed remote code execution with usable memory disclosure against an Apache mod_php honeypot installation running PHP 8.4.26, not just a crash. The researcher cautioned the honeypots used a single-worker configuration that favoured the exploit, so the result may not carry over to production servers. A honeypot is a deliberately vulnerable decoy system set up to observe attackers. Expel's Marcus Hutchins called it the highest-quality confirmation of PHP exploitation since the crisis began. CISA had already added both PHP flaws to KEV on October 26, with a deadline of October 29 — meaning the confirmation landed just as the patch deadline arrived.
PHP gets them in the door. Fragnesia hands them the keys to the building.
Why It Matters
This is the week the PHP crisis moved from warnings to confirmed damage. Since the PHP flaws were disclosed, defenders have been patching against attempts; now there is confirmed remote code execution against honeypots running a current PHP version, on a single-worker Apache mod_php configuration that favoured the exploit. The distinction between attempts and success matters enormously: attempts mean attackers are trying, success means they are getting in. Every organisation running PHP that has not patched by the October 29 deadline should assume the risk is no longer hypothetical.
Fragnesia makes the situation worse in a specific, mechanical way. Many security teams triage flaws by severity score, and a 7.8 is serious but not critical. But Fragnesia's danger is not its score alone — it is that it converts a web-server compromise into a full host takeover. A PHP webshell is bad; a PHP webshell plus root is a machine the attacker owns completely, able to install persistent malware, steal data and move deeper into the network. The three-day patch deadline reflects that chaining risk, and it is why this flaw jumps the queue ahead of higher-scored flaws that do not chain.
The read-through tickers are the endpoint and network security vendors whose customers are patching this week: Palo Alto Networks and CrowdStrike, plus Broadcom, which owns VMware and therefore the virtualisation layer many of these servers run on. None of them is at fault here — the flaws are in Linux and PHP — but their customers' exposure is the story, and the speed of patching across federal agencies and enterprises will be the measure of whether this week ends as a contained incident or a widespread compromise.
Analyst's Take
Two clocks are running, and both are nearly out. The PHP patch deadline was October 29; the Fragnesia deadline is October 31. Organisations that patched PHP but not the kernel are still exposed to the chain, and organisations that patched neither are exposed to confirmed, successful exploitation. The verdict is Bearish because the threat has now been demonstrated end to end: a way in, confirmed in the wild, plus a way up to full control, with a three-day fuse.
What to watch next is the exploitation count. Dream's 25 firewalls on October 23-24 were the early signal; if the confirmed PHP exploitation spreads beyond honeypots into real production servers, expect emergency CISA directives and a much louder week. For now, the advice is the deadline itself: patch PHP immediately if not done, and patch the kernel by October 31. This is not a story where waiting for more information is the safe move.
By The Numbers
FAQ
What is CISA's KEV catalog?
The Known Exploited Vulnerabilities catalog is CISA's list of flaws that are known to be actively exploited. US federal agencies must patch listed flaws by the stated deadline. When a flaw lands on KEV, it is a signal that exploitation is real, not just possible.
What does 'chaining' flaws mean?
Using two or more flaws together, where each one alone gets partway and the combination gets all the way. Here, the PHP flaws give attackers a foothold as the web-server user, and Fragnesia escalates that foothold to root — full control of the machine.
What is root access?
The highest privilege level on a Linux system, able to read, change or delete anything and install any software. An attacker with root effectively owns the machine, which is why the jump from web-server user to root is so serious.
Is this a repeat of the October 28 CISA story?
No. The October 28 post covered CISA adding the Adobe Commerce PolyShell flaw and the Brotli decoder flaw to KEV. This is a different KEV addition — the Linux kernel Fragnesia flaw — plus the first confirmed successful exploitation of the PHP flaws, a new development on the October 24 PHP2Shell story.
What should organisations do?
Patch the PHP flaws immediately if not already done — the federal deadline was October 29 — and patch the Linux kernel flaw by October 31. Check web servers for webshells, since a successful PHP exploitation may already have planted one.
👁
Source: Carthage Electronics CVE brief