The Cybersecurity and Infrastructure Security Agency (CISA) added a Linux kernel flaw known as Fragnesia to its list of actively exploited vulnerabilities Wednesday, giving federal civilian agencies until Oct. 31 to fix it and requiring them to check for signs of compromise. CISA says the flaw can be chained with the PHP2Shell bugs to run commands as root, the highest level of control on a system, turning a web-software flaw into a full takeover of perimeter devices.
What Happened
CISA's alert added two flaws based on evidence of active exploitation: the kernel bug, CVE-2026-46300, and a VMware ESX logging flaw, CVE-2026-41709. The catalog entry for the kernel flaw says it can be combined with the two PHP2Shell flaws to plant web shells, small scripts that give an intruder remote control, and run commands as root. It requires forensic triage under Binding Operational Directive 26-04, meaning agencies must look for intrusions, not just patch.
PHP's maintainers fixed the PHP2Shell flaws Oct. 21; their federal deadline was Oct. 29.
Separately, security firm Dream said in vendor research dated Oct. 26 that an attacker combined a non-public PHP2Shell exploit with Fragnesia to go from no login to a persistent root web shell in under 15 minutes. SecurityWeek reported the findings Wednesday.
According to Dream, the attacker used the Chinese search engine FOFA to find about 19,000 internet-facing firewalls from one vendor and narrowed them to 240 targets in the U.S., Japan, Taiwan and South Korea. It rooted 24 in an automated batch; 22 got only a web shell. At an unnamed U.S. government-affiliated organization, the attacker used a compromised firewall and a reverse SSH tunnel, a hidden connection back to the attacker, to exploit an internal firewall management server, the 25th system. Dream says the attacker decrypted a directory service-account password and listed domain users. Password spraying and attempts to create Active Directory backdoor accounts followed, but Dream says it cannot confirm whether those steps succeeded.
Dream names neither the firewall vendor nor a threat actor. It says the targeting, tooling, UTC+8 timestamps and Chinese-language prompts point to a Chinese-nexus operation. It found AI tools on the attacker's systems but says it has no direct evidence AI wrote the exploit.
Why It Matters
Patching alone may not undo damage on devices already hit. The chain needs no credentials and targets equipment guarding the network edge. In Dream's account, one firewall led to a server holding configurations and credentials for every firewall the organization managed. CISA's forensic requirement signals that agencies should assume exposed systems may already be compromised. For boards, the immediate question is whether any firewall management interface is reachable from the internet; Dream says that one never should have been.
Context
The Primary Wire reported Tuesday, citing CISA, that federal agencies had until Oct. 29 to fix the PHP2Shell flaws. It reported Wednesday, citing the company's advisory, that Palo Alto Networks says PHP2Shell attacks target its exposed firewall management interfaces; that advisory, updated Oct. 29, shows one PAN-OS hotfix still pending, with an Oct. 30 estimate. A third PHP flaw still has no fix on php.net.
What to Watch
Watch whether the unnamed vendor is identified and ships fixes, whether the government-affiliated victim is named, and whether agencies meet the Oct. 31 deadline. Dream published no file hashes or IP addresses, so look for indicators defenders can check against their logs.
