Fragnesia (CVE-2026-46300) turns a PHP2Shell foothold into root on Linux. CISA lists it as exploited. How to check your clients' servers.
The attackers didn't crack the root password. They made the server stop asking for one. Researchers at Dream describe one unauthenticated web request against a firewall's admin page that landed a shell, then used a Linux kernel bug called Fragnesia to rewrite the login rules in memory, so su root worked with no password at all.
On October 28, 2026, CISA added Fragnesia (CVE-2026-46300) to its Known Exploited Vulnerabilities catalog, noting it "can be chained with" the two PHP2Shell flaws "to plant PHP webshells and run commands as root."
/etc/pam.d/su, and audit Active Directory for new accounts.Fragnesia is a Linux kernel local privilege escalation bug in the XFRM ESP-in-TCP code that lets an ordinary user write bytes into the in-memory copy of files they can only read. Researcher William Bowling disclosed it on May 13, 2026, with a public proof-of-concept, according to BleepingComputer, and it works "without requiring any race condition."
Think of the page cache as the photocopy the kernel hands out whenever a program reads a file. Fragnesia lets an attacker scribble on the photocopy. The original on disk stays clean, but every program reads the scribbled copy. Ubuntu rates it High, calling it a "trivial local privilege escalation." On its own, Fragnesia needs a foothold. PHP2Shell provides one.
Dream's report says the attackers used a custom PHP2Shell exploit against a firewall's PHP 8.0.30 management server, running code as the nobody user, then used Fragnesia to become root, all from one unauthenticated HTTPS request in under 15 minutes.
SELinux boxed in the web process, so the attackers needed root. Fragnesia overwrote /etc/pam.d/su, the file that decides who may switch to root, with a rule (pam_permit.so) that accepts everyone.
Dream describes a production line: about 19,000 internet-facing firewalls found through the FOFA search engine, 240 targeted, 24 rooted in the automated batch, a 103-byte PHP webshell on each, and an 8-port reverse SSH tunnel kept alive by a systemd service and an rc.local boot hook. The attackers then ran the same chain through the tunnel against an internal firewall management server.
From there they went for Active Directory. Dream says they decrypted the firewall's LDAP service account password from its config and listed every domain user and group. The domain had no account lockout (lockoutThreshold=0), and MachineAccountQuota sat at its default. Whether the follow-up password spray and backdoor accounts worked is unknown.
Dream withheld the firewall vendor and firmware versions. Victims were in the United States, Japan, Taiwan and South Korea, including US government-affiliated systems. The 25-server total is Dream's own count, and we found no independent confirmation of it.
Dream found Claude Code and an AI offensive platform, aiscan, configured with DeepSeek and Kimi, on the attacker infrastructure, but says there is "no direct evidence" AI wrote the exploit, and names no actor. Mass scanning plus automated exploitation of 240 targets is an intrusion, not a pentest: a pentest is authorised, scoped and reported to the owner.
A client server is exposed when its kernel lacks the Fragnesia fix and an attacker can run any code on it; unpatched PHP is today's proven route. Ubuntu lists fixes such as 6.8.0-124.124 for 24.04 LTS and 5.15.0-181.191 for 22.04 LTS. Tenable lists AlmaLinux 9's fix as kernel-5.14.0-611.54.4.el9_7 and says Amazon Linux does not ship the vulnerable module. CISA warns PHP "is often a component of other software," so appliances count too.
Start with the fleet loop at the end of this list, which runs checks 2 to 5 in one pass, then run checks 1 and 6 to 8 on any server it flags. Do not reboot first: the PAM change lives in memory, so a reboot may erase it.
D=/root/ir-$(hostname)-$(date +%F); sudo mkdir -p "$D"
sudo cp -a /etc/pam.d /etc/systemd/system /etc/rc.local /var/log "$D"/
sudo find "$D" -type f -exec sha256sum {} + | sudo tee "$D.sha256"
uname -r. Pass: the running version is at or above the fixed build on your distro's page.lsmod | grep -E '^(esp4|esp6|rxrpc) '. Pass: no output.grep -n pam_permit /etc/pam.d/su. Pass: no output. Then compare sha256sum /etc/pam.d/su with a clean server on the same release; pass: the hashes match.php -v, and the FPM binary's -v if one exists. Pass: 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later in that branch.rc.local line and SSH connection.sudo find /etc/systemd/system -name '*.service' -newermt 2026-10-08
sudo cat /etc/rc.local
sudo ss -tnp state established | grep -E 'ssh|iox'
sh, bash or download tool under a worker. It only shows processes still running.ps -eo pid,ppid,user,comm,args --forest | grep -A3 -E 'php-fpm|httpd|apache2|nginx'
sudo find / \( -path /proc -o -path /sys \) -prune -o -name '*.php' -size -200c -newermt 2026-10-08 -print
The fleet loop for checks 2 to 5, reading host names from hosts.txt:
for h in $(cat hosts.txt); do echo "== $h"; ssh "$h" 'uname -r; lsmod | grep -E "^(esp4|esp6|rxrpc) "; grep -n pam_permit /etc/pam.d/su; php -v | head -1'; done
For firewalls, run nmap -Pn -p 443,4443,8443 <public-ip> from outside. Pass: nmap shows the admin port as closed or filtered. For the domain, run this from a machine with the ActiveDirectory module. Pass: every new account is one the client's IT staff created.
$d = Get-Date '2026-10-08'
Get-ADUser -Filter 'whenCreated -ge $d' -Properties whenCreated | Select-Object Name,whenCreated
Get-ADComputer -Filter 'whenCreated -ge $d' -Properties whenCreated | Select-Object Name,whenCreated
(Get-ADDefaultDomainPasswordPolicy).LockoutThreshold
(Get-ADObject (Get-ADDomain).DistinguishedName -Properties ms-DS-MachineAccountQuota).'ms-DS-MachineAccountQuota'
Patch the kernel and reboot once evidence is saved, then confirm uname -r shows the fixed build. Work through these in order:
-Reset, then update the firewall's LDAP settings. Pass: Get-ADUser <svc> -Properties PasswordLastSet shows today.sudo rmmod esp4 esp6 rxrpc
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' | sudo tee /etc/modprobe.d/dirtyfrag.conf
Set-ADDefaultDomainPasswordPolicy (Get-ADDomain) -LockoutThreshold 10
Set-ADDomain (Get-ADDomain) -Replace @{'ms-DS-MachineAccountQuota'=0}
Set-ADAccountPassword -Identity <svc> -Reset -NewPassword (Read-Host -AsSecureString 'New password')
Dream's attackers did reconnaissance at scale: find exposed admin pages, fingerprint versions, exploit, pivot into AD. KinoSec runs the same reconnaissance with your client's permission, scope limits and a report they can act on. It maps each client's external network, flags a firewall admin page reachable from the internet, tests web apps for exploitable flaws, and checks Active Directory for weaknesses such as a missing lockout policy. You hand your client a findings report with remediation before someone else's scanner finds the gap.
Fragnesia is a Linux kernel privilege escalation flaw in the XFRM ESP-in-TCP code, disclosed on May 13, 2026. It lets a local user write into the in-memory copy of read-only files and become root. CISA added it to its Known Exploited Vulnerabilities catalog on October 28, 2026.
Save evidence first, then run grep -n pam_permit /etc/pam.d/su; any output needs investigation. Run sudo ss -tnp state established | grep -E 'ssh|iox' to look for reverse SSH tunnels. Search for tiny PHP files with sudo find / -name '*.php' -size -200c -newermt 2026-10-08.
Install your distribution's patched kernel and reboot after preserving evidence; Ubuntu 24.04 LTS is fixed in 6.8.0-124.124. If you cannot patch, block the esp4, esp6 and rxrpc modules, which breaks IPsec VPNs.
By Dream's count, 25 servers, mostly firewall appliances, including US government-affiliated systems. Dream withheld the firewall vendor, and we found no independent confirmation of the total.