PHP2Shell Kernel Patch: Fragnesia Turns PHP Access Into Root

Attackers are chaining the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) with Fragnesia, a Linux kernel bug tracked as CVE-2026-46300, to go from one unauthenticated web request to root. Plan the PHP2Shell kernel patch together with the PHP update: a WordPress update closes neither hole, and a routine reboot can erase the evidence.

Why can a fully patched WordPress site still be hit?

A fully patched WordPress site can still be hit because PHP2Shell lives in the PHP interpreter, not in WordPress, Joomla, a theme or a plugin. The PHP Foundation disclosed the two flaws last week as CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 on CVSS and lets an attacker with no account run code on the server.

That code runs as the account PHP uses (usually www-data, apache or a per-site user), not root. Aaron Beardslee, manager of threat research at Securonix, notes that the damage then depends on what that account can reach: configuration files, database credentials and internal services. On a WordPress host, that starts with wp-config.php.

WordPress alone runs about 43% of sites, and PHP also powers Drupal, Mailchimp and parts of Slack and Zoom. After the disclosure, some government and enterprise sites went offline entirely while they waited for fixes.

End-of-life PHP branches get no security updates, so move off them now. Then check every runtime: the CLI binary, PHP-FPM pools, mod_php, containers and vendor-bundled copies can each run a different version, and php -v reports only the command line.

What is Fragnesia, and how does the web user become root?

Fragnesia is CVE-2026-46300, a Linux kernel local privilege-escalation flaw in the Dirty Frag class that CISA describes as high severity. CISA has warned about it, and federal agencies have been ordered to patch.

Researchers at Dream Security say one actor built two exploits and chained them: PHP2Shell for code execution as the service account, Fragnesia for root. Against Palo Alto Networks firewalls running a vulnerable PAN-OS build, the chain reached root in a single HTTP request with no credentials.

“PHP2Shell allows for remote access, but that access is typically limited by the account used to run the PHP service. By chaining with CVE-2026-46300, that attacker can get unlimited access.” (Scott Miserendino, CTO, DataBee)

Two details change how you patch. Beardslee says the Fragnesia fix is not part of the earlier Dirty Frag patches, so a host patched for Dirty Frag may still be exposed. And Miserendino says the only real remedy is a patched kernel: workarounds could break the system or, at a minimum, require disabling IPsec ESP, which can introduce additional flaws.

How far did the chain go inside the networks Dream Security tracked?

Dream Security counts 25 breached servers, three of them affiliated with the US government. Beardslee describes them as mostly firewall appliances on a government-affiliated network. The chain ran from the perimeter firewall into Active Directory.

Within hours, the operators had a reverse SSH tunnel to an internal management server. Because it dials out from inside, perimeter rules built mainly to block inbound traffic let it through. They then recovered an LDAP service account credential, listed domain users and groups, sprayed passwords and tried to create backdoor AD accounts.

The haul, per the researchers: a full AD user and group listing, private keys, a complete network map (IP, hostname, server role, VPN gateway) and decrypted service account credentials. The actor also “parked” nearly two dozen firewalls in the US, Japan, Taiwan and South Korea for later exploitation, a claim not independently confirmed.

“The operation illustrates how an exposed management interface can become a path into an organization’s identity infrastructure,” Dream Security wrote. Management interfaces belong on a trusted admin network or behind an allowlist.

Beardslee calls attribution “openly contested.” Dream Security reports AI-assisted tooling, including Claude Code and offensive platforms configured with the Chinese DeepSeek and Kimi models. Treat that as low confidence.

Public reporting does not yet include affected PHP version ranges, PAN-OS build numbers, a numeric CVSS score for CVE-2026-46300 or fixed kernel versions. Take indicators of compromise from vendor and CISA advisories.

Shared hosting or your own server: who handles the PHP2Shell kernel patch?

On shared hosting your provider patches both PHP and the kernel. On a VPS or dedicated server, you or your admin do.

• Shared hosting. Ask your host which PHP branch serves your site, whether it includes the PHP2Shell fixes, and whether the production kernel fixes CVE-2026-46300 specifically, not only Dirty Frag. Use the control panel’s PHP selector to move off end-of-life versions. Our analysis of the cPanel root shell flaw explains why one tenant’s root becomes every tenant’s problem.
• VPS or dedicated. Update PHP, then restart every PHP-FPM pool and the web server so the new binary loads. Install the patched kernel and schedule the reboot, after the evidence steps below if anything looks wrong.
• Appliances. For PAN-OS and similar boxes, follow the vendor advisory.

Meanwhile, check whether the esp4 and esp6 kernel modules (IPsec ESP) are loaded on internet-facing Linux hosts. If nothing terminates IPsec there, Beardslee says, “the modules have no business being loaded,” and unloading them removes the vulnerability path without a reboot. If the host runs IPsec, prioritize the kernel update.

Why do file integrity checks miss this, and what should you save before rebooting?

File integrity tools compare files on disk, and Fragnesia’s payload never touches the disk. Beardslee explains that the escalation step writes into the page cache, the kernel’s in-memory copy of files: processes read the altered version while the on-disk hash stays clean.

“What matters is that the privilege escalation step in this chain is invisible to disk-based integrity checking, and that the standard remediation advice destroys the evidence of it.” (Aaron Beardslee, Securonix)

A reboot empties the page cache. On a suspect host, isolate it but keep it powered on, capture memory, active connections and the process list, copy logs to a remote store, then patch and reboot.

The PHP stage can still leave web shells, odd files in upload folders or new cron jobs, which a server-side scanner such as SiteGuarding Antivirus will find. It just won’t see the kernel step.

Then assume secrets have left the box. “Web servers have an unfortunate habit of knowing more about the rest of the environment than anyone intended,” Beardslee says. Rotate database passwords, API keys, SSH keys and directory credentials, and consider a clean rebuild. Patching does nothing about tunnels, accounts or keys the attacker already holds.

What should regulated firms and leadership take from this?

A scanner reports two separate findings: a 9.2 in PHP and a kernel bug that needs local access, which often gets triaged for later. The real risk sits in the connection between them.

A manual penetration test with post-exploitation checks what the service account can read, whether config files hold LDAP credentials and whether the host can reach domain controllers. Under NIS2 or DORA, chained compromise of identity infrastructure is the scenario testing should cover. Our guide to DORA penetration testing and TLPT covers scoping.

Leadership decisions for this week:

• Approve an emergency patch window, including kernel reboots.
• Name one owner for the PHP runtime and kernel inventory.
• Confirm no firewall or appliance management interface is reachable from the internet.
• Include post-exploitation and identity paths in the next test scope.

What should a site owner do this week?

On a VPS or dedicated server, these read-only checks show where you stand before you change anything:

1. Update every PHP runtime that check found, restart the services and confirm each binary’s version.
2. Install a kernel that fixes CVE-2026-46300. Earlier Dirty Frag patches do not count.
3. Unload esp4 and esp6 on internet-facing hosts that do not terminate IPsec, and block them from reloading.
4. On shared hosting, get written confirmation of the PHP branch and kernel status from your provider.
5. Alert on LDAP binds from any host not allowed to hold a directory credential. Beardslee calls it “the control that catches the chain at the stage where it stops being a web server problem and starts being a domain problem.”
6. Hunt for password spraying by grouping failed logins by source and time window across many accounts. A low per-account failure count is not proof of harmless activity.
7. Watch for unexpected outbound SSH from web servers and appliances.
8. If a host looks compromised, capture memory before you reboot, then rotate every secret it could read.

FAQ

Does updating WordPress fix PHP2Shell?

No. PHP2Shell is in the PHP interpreter, so every runtime serving your site needs patched PHP packages; on shared hosting, your provider applies them.

Can PHP2Shell give an attacker root on my server?

Not by itself. It runs code as the PHP service account, and attackers then use the Fragnesia kernel flaw, CVE-2026-46300, to escalate to root.

Is CVE-2026-46300 fixed by earlier Dirty Frag patches?

No. Install a kernel that names CVE-2026-46300 specifically.

How do I check if my VPS kernel is vulnerable to Fragnesia?

Run uname -r, then search your distribution's kernel changelog for CVE-2026-46300. If the running kernel does not list it, install the patched kernel and reboot, after capturing evidence if anything looks wrong.

Not sure which PHP runtime or kernel your sites actually run, or whether something already got in? Our team can check and clean it up with server-side protection and cleanup.