--- title: PHP2Shell plus Fragnesia: A dangerous new route from web... description: Attackers are chaining the PHP2Shell remote code execution bugs with a new Linux kernel privilege escalation flaw, CVE-2026-46300 (Fragnesia), to gain root... canonical: https://daily.dev/posts/php2shell-plus-fragnesia-a-dangerous-new-route-from-web-server-to-root-i4taywxlf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PHP2Shell plus Fragnesia: A dangerous new route from web server to root | daily.dev og:description: Attackers are chaining the PHP2Shell remote code execution bugs with a new Linux kernel privilege escalation flaw, CVE-2026-46300 (Fragnesia), to gain root... og:url: https://daily.dev/posts/php2shell-plus-fragnesia-a-dangerous-new-route-from-web-server-to-root-i4taywxlf og:image: https://api.daily.dev/og/posts/I4taywxlf.png og:image:alt: PHP2Shell plus Fragnesia: A dangerous new route from web server to root og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PHP2Shell plus Fragnesia: A dangerous new route from web server to root **[CSO Online](https://daily.dev/sources/csoonline)** · 6 min read · 0 upvotes · 0 comments ## Summary Attackers are chaining the PHP2Shell remote code execution bugs with a new Linux kernel privilege escalation flaw, CVE-2026-46300 (Fragnesia), to gain root access on vulnerable servers. Dream Security researchers tracked an attack that rooted Palo Alto Network firewalls running vulnerable PAN-OS builds with a single unauthenticated HTTP request. Attackers then tunneled into internal networks, extracted Active Directory credentials, private keys, and full network topology, and parked about two dozen firewalls across the US, Japan, Taiwan and South Korea for later use. The kernel bug writes its payload to the page cache instead of disk, making it invisible to disk-based integrity checks, and rebooting to patch erases the evidence. Researchers recommend capturing memory before patching and auditing the esp4 and esp6 kernel modules. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Fragnesia vulnerability CVE-2026-46300 and why is it dangerous when chained with PHP2Shell? CVE-2026-46300, called Fragnesia, is a high severity Linux kernel local privilege escalation flaw in the Dirty Frag vulnerability class. Chained with the PHP2Shell remote code execution bugs, it turns limited web-service-account access into full root permissions. Attackers used it to root Palo Alto Network firewalls running vulnerable PAN-OS builds in a single unauthenticated HTTP request, then tunneled into internal networks and Active Directory. _Teams tracking kernel and PHP CVEs chained together can follow fast-moving exploit writeups on daily.dev._ ### Why can't disk-based integrity checking detect the Fragnesia kernel exploit? The Fragnesia kernel bug writes its payload into the page cache rather than to disk, so file-integrity monitoring never sees it. Rebooting the system to apply the kernel patch actually destroys this evidence, since the payload lives only in memory. Researchers recommend capturing memory for forensic analysis before patching and auditing the esp4 and esp6 kernel modules on internet-facing Linux hosts. _Defenders weighing patch timing against evidence preservation can track incident writeups like this on daily.dev._ ### How should I remediate CVE-2026-46300 on a Palo Alto Networks PAN-OS firewall? Upgrade to a patched Linux kernel version, since that is the only true remedy for CVE-2026-46300. Before patching, capture memory on any suspected host because the Fragnesia fix is not included in the Dirty Frag patches and rebooting erases forensic evidence. Also audit and consider unloading the esp4 and esp6 kernel modules if nothing on the host terminates IPsec ESP traffic, and monitor for LDAP binds from unexpected hosts. _Teams planning kernel patch rollouts can keep up with emerging firewall CVEs via daily.dev._ ## Similar posts on daily.dev - [Meet Fragnesia, the third Linux kernel vulnerability in a month](https://daily.dev/posts/meet-fragnesia-the-third-linux-kernel-vulnerability-in-a-month-bcgeuj59z) · CSO Online · 3 upvotes · 0 comments - [Dirty Frag gets a sequel as Fragnesia hands Linux attackers root-level access](https://daily.dev/posts/dirty-frag-gets-a-sequel-as-fragnesia-hands-linux-attackers-root-level-access-vsqqsvbcs) · The Register · 4 upvotes · 0 comments - [Fragnesia Linux kernel local privilege escalation vulnerability mitigations](https://daily.dev/posts/fragnesia-linux-kernel-local-privilege-escalation-vulnerability-mitigations-ewyawshyk) · Ubuntu · 0 upvotes · 0 comments - [Dirty Frag \(CVE-2026-43284\): Linux Root Escalation](https://daily.dev/posts/dirty-frag-cve-2026-43284-linux-root-escalation-wu6rpu77n) · Aikido Security · 11 upvotes · 4 comments - [I Found Root Access on Critical Financial Infrastructure Using a Two-Day-Old Kernel Exploit](https://daily.dev/posts/i-found-root-access-on-critical-financial-infrastructure-using-a-two-day-old-kernel-exploit-ymu1rmoi7) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#active-directory](https://daily.dev/tags/active-directory) [View this post on daily.dev](https://daily.dev/posts/php2shell-plus-fragnesia-a-dangerous-new-route-from-web-server-to-root-i4taywxlf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PHP2Shell plus Fragnesia: A dangerous new route from web server to root","url":"https://daily.dev/posts/php2shell-plus-fragnesia-a-dangerous-new-route-from-web-server-to-root-i4taywxlf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/php2shell-plus-fragnesia-a-dangerous-new-route-from-web-server-to-root-i4taywxlf"},"datePublished":"2026-10-30T00:56:24.392Z","dateModified":"2026-10-30T13:40:23.570Z","description":"Attackers are chaining the PHP2Shell remote code execution bugs with a new Linux kernel privilege escalation flaw, CVE-2026-46300 (Fragnesia), to gain root...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e18e037da42290b1eca8575aeea92b30?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e18e037da42290b1eca8575aeea92b30?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/php2shell-plus-fragnesia-a-dangerous-new-route-from-web-server-to-root-i4taywxlf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux,active-directory","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"PHP2Shell plus Fragnesia: A dangerous new route from web server to root"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/php2shell-plus-fragnesia-a-dangerous-new-route-from-web-server-to-root-i4taywxlf#faq","mainEntity":[{"@type":"Question","name":"What is the Fragnesia vulnerability CVE-2026-46300 and why is it dangerous when chained with PHP2Shell?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-46300, called Fragnesia, is a high severity Linux kernel local privilege escalation flaw in the Dirty Frag vulnerability class. Chained with the PHP2Shell remote code execution bugs, it turns limited web-service-account access into full root permissions. Attackers used it to root Palo Alto Network firewalls running vulnerable PAN-OS builds in a single unauthenticated HTTP request, then tunneled into internal networks and Active Directory. Teams tracking kernel and PHP CVEs chained together can follow fast-moving exploit writeups on daily.dev."}},{"@type":"Question","name":"Why can't disk-based integrity checking detect the Fragnesia kernel exploit?","acceptedAnswer":{"@type":"Answer","text":"The Fragnesia kernel bug writes its payload into the page cache rather than to disk, so file-integrity monitoring never sees it. Rebooting the system to apply the kernel patch actually destroys this evidence, since the payload lives only in memory. Researchers recommend capturing memory for forensic analysis before patching and auditing the esp4 and esp6 kernel modules on internet-facing Linux hosts. Defenders weighing patch timing against evidence preservation can track incident writeups like this on daily.dev."}},{"@type":"Question","name":"How should I remediate CVE-2026-46300 on a Palo Alto Networks PAN-OS firewall?","acceptedAnswer":{"@type":"Answer","text":"Upgrade to a patched Linux kernel version, since that is the only true remedy for CVE-2026-46300. Before patching, capture memory on any suspected host because the Fragnesia fix is not included in the Dirty Frag patches and rebooting erases forensic evidence. Also audit and consider unloading the esp4 and esp6 kernel modules if nothing on the host terminates IPsec ESP traffic, and monitor for LDAP binds from unexpected hosts. Teams planning kernel patch rollouts can keep up with emerging firewall CVEs via daily.dev."}}]} ```