Fragnesia: How a Linux Kernel Bug Turns a Hacked Web Server Into Full Root Access

Key points

• Dream Security researchers confirmed 25 servers breached, including three linked to the US government, using a chain of three vulnerabilities now on CISA's actively-exploited list.
• CVE-2026-46300 (nicknamed Fragnesia), a Linux kernel flaw, is the critical link that converts limited web-server access into unrestricted root control of a machine.
• CVE-2026-109618 and CVE-2026-109619, both rated CRITICAL at 9.2, are flaws in PHP, the programming language that underpins WordPress and roughly 43% of all websites, and allow attackers in without any username or password.
• US federal agencies face patch deadlines for both PHP flaws and the Linux kernel flaw, per the CISA Known Exploited Vulnerabilities catalogue.

Think of a web server like a locked office building. PHP is the front door. The Linux kernel is the master key cabinet inside. This attack breaks the front door, walks to the cabinet, and copies every key.

We've been tracking PHP2Shell since it first surfaced on 23 October; our report "PHP2Shell: The Patch Gave Attackers Their Roadmap" documented millions of exploit attempts within hours of disclosure. Fragnesia is the next chapter.

What are the three flaws and why do they fit together?

The two PHP flaws came first. PHP is the programming language that powers a huge share of the internet, including WordPress, which runs on more than 43% of all websites. The PHP Foundation disclosed CVE-2026-109618 and CVE-2026-109619 on 2026-10-21; both carry a CVSS score of 9.2. Together they're tracked as PHP2Shell.

The first flaw triggers when PHP runs out of memory mid-request and exits messily, leaving some internal memory in an uninitialized, or blank, state. A cleanup step then reads that blank memory and can be steered into running attacker code. The second is related: PHP keeps global state, essentially a shared notepad, that's supposed to be wiped clean between requests. Under certain conditions it isn't, meaning the next request can read leftovers and be similarly hijacked. Neither flaw requires a password. An attacker just sends a crafted web request.

That gets a criminal into the server, but only with the limited permissions of the web service account. That's where CVE-2026-46300 enters. Nicknamed Fragnesia and classed as part of the Dirty Frag family of Linux kernel privilege-escalation bugs, it sits in the deepest layer of the operating system. The bug involves how the kernel handles network data parcels called socket buffers. When two buffers are merged, a flag indicating that certain memory fragments are shared with the page cache (a region of memory the kernel treats as belonging to the disk) can get lost. A security layer called ESP (which handles encrypted network traffic) then assumes the memory is safe to write into directly, and decrypts data in place over memory it shouldn't touch. An attacker who already has code execution through PHP can exploit this to plant a small program that writes directly into the page cache and gain root access, full control of the entire machine.

Because the payload lands in memory rather than on disk, standard integrity-checking tools that watch for changed files will see nothing.

Should ordinary website owners and their visitors worry?

Yes, but in a specific way. A fully updated WordPress site with all current plugins can still be vulnerable if the PHP version underneath it hasn't been patched. That's the part worth checking first.

Visitors to affected sites aren't directly targeted by this chain; the criminals are after the servers themselves. But once attackers have root access and can query a company's directory of user accounts, stolen credentials can surface later in phishing emails or account-takeover attempts. If you have an account on a site you think may have been affected, changing your password and switching on multi-factor authentication (a second check, like a code sent to your phone) is sensible.

What should the people running servers do right now?

Patch PHP first, then the Linux kernel. The Fragnesia fix isn't bundled with earlier Dirty Frag patches, so check explicitly that CVE-2026-46300 is covered in whatever update you apply.

Aaron Beardslee of Securonix, quoted in CSO Online's coverage of the research, offers one actionable shortcut: check whether the Linux kernel modules esp4 and esp6, which handle encrypted network traffic, are loaded on any internet-facing server. If nothing on that server actually uses IPsec, those modules can be unloaded immediately, closing the exploitation path without waiting for a maintenance window. Beardslee also recommends alerting on LDAP binds (connection attempts to your directory service) from any host not authorised to make them.

Capture a memory image of any server you suspect was already reached before you reboot it. The reboot is what erases the only evidence Fragnesia leaves behind.