Attackers are chaining the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) with Fragnesia, a Linux kernel bug tracked as CVE-2026-46300, to go from one unauthenticated web request to root. Plan the PHP2Shell kernel patch together with the PHP update: a WordPress update closes neither hole, and a routine reboot can erase the evidence.
