The Firewall Chain Needed Two Bugs. CISA Put a Deadline on One of Them. The Other Has Been Public Since May 13.
Federal agencies have until today to mitigate the two PHP flaws known as PHP2Shell. That deadline is correct and you should meet it. It also closes half a door.
On October 23 and 24, an operator used those PHP flaws to get a web shell onto 25 internet-facing firewalls — and then chained a second bug, a Linux kernel privilege escalation called Fragnesia, to turn that web shell into root. The research firm Dream, which documented the campaign, reports a PHP root web shell on 24 devices, no further activity on 22 of them, and two servers in a US government-affiliated environment where the operator kept going: a reverse SSH tunnel for persistence, access to an internal firewall management server holding the configurations and credentials for every firewall that organization managed, an LDAP service account password decrypted, domain users and groups enumerated, password spraying, and attempts to create Active Directory backdoor accounts.
The PHP half of that chain was added to the CISA Known Exploited Vulnerabilities catalog on October 26, five days after its exploit went public.
The kernel half is not on the list. We read CISA's own catalog file this morning — version 2026.10.27, 1,760 entries — and searched it for CVE-2026-46300. Zero matches. It has been publicly disclosed, with a working proof of concept and a patch, since May 13. That is 168 days.
What Fragnesia actually is
CVE-2026-46300 is a logic flaw in the Linux kernel's XFRM ESP-in-TCP subsystem, found and reported by William Bowling of V12 Security. It permits arbitrary byte writes into the page cache of read-only files, with no race condition to win. The public proof of concept overwrites the cached copy of the su binary, which is as direct a path to root as it sounds. CVSS 7.8.
It is a successor to Dirty Frag, and the Dirty Frag patches do not cover it.
The disclosure on May 13 was the responsible kind and the complete kind at once: Bowling published the flaw, a working exploit, and the kernel patch on the same day, and the CVE was assigned that day. Everything a defender needed was on the table in May. Everything an attacker needed was too.
What we hold, and what we don't
Our exploit harvester indexes public proof-of-concept repositories from GitHub automatically. It picked up the first Fragnesia PoC on May 16, three days after disclosure, and two more since — one on July 1 and one on August 14.
We want to be precise about what that is and is not. The code is somebody else's. The harvest date is when we indexed a public thing, not when we detected an attack. We were not ahead of anyone; we were watching a public shelf and writing down what appeared on it. The useful fact is not that we had it. It is that a working root exploit for a widely deployed kernel subsystem has been sitting in public for five and a half months, in at least three copies, and the catalog that carries federal deadlines does not mention it.
What we do not hold is any sighting of our own. Our edge saw no Fragnesia activity, and it structurally cannot: this is a local privilege escalation, and a perimeter instrument is blind to local privilege escalation by definition. We checked anyway, across 37,960 blocked requests, 23,882 edge-honeypot records and 1,370 origin captures since October 1. The single hit that matched was a path traversal probe against a shared pattern, not this exploit. That is not modesty, it is the shape of the bug — and it is worth saying plainly, because "our sensors show nothing" means nothing at all when the sensors face the wrong direction.
The obvious objection, and why it does not hold
The reasonable reply is that KEV is for remotely exploitable things and local privilege escalation is a different category.
It is not, and CISA's own file says so. The catalog added 12 privilege-escalation entries in 2026. Three of them are Linux kernel bugs. One of them, CVE-2026-31431, went on the list on May 1 — twelve days before Fragnesia was disclosed, and we wrote about that one at the time. Dirty Pipe has been in the catalog since 2022.
The category is catalogued. This entry is not. We do not know why, we are not assuming bad faith, and the honest reading is the simple one: a catalog assembled by humans with finite throughput has a backlog, and this is what a backlog looks like from the outside when an attack chain finally walks through the gap.
It is worth noting what else that throughput ceiling has been doing. Five of October's thirty KEV additions were CVEs disclosed between 2015 and 2023. Seventeen percent of the month's must-patch list was catch-up. A list that is clearing a decade-old backlog is not a list with spare capacity for a five-month-old kernel bug, however good the exploit is.
One correction we owe
An earlier read of ours said we held nothing on Fragnesia. That was wrong, and it was wrong for an instructive reason.
We asked our own search index, which covers the blog, the indicator corpus, advisories and actor profiles, and got nothing back. The harvester markers were in a lane that query does not rank well. The right instrument was the edge and PoC tool that reads the harvester lane directly, and when we ran it, three PoC repositories came back with dates in May, July and August.
We have a rule for this and we broke it for about an hour: never answer "did we see X" from one instrument. The cost here was small because we checked before publishing. It is the same failure mode that produces a confident public zero, and the only reason it did not this time is that somebody ran the second query.
What to do today
Meet the PHP deadline. Then close the other half.
The Fragnesia mitigation has been free and available since May 13. Unload the esp4, esp6 and rxrpc kernel modules, blacklist them with a modprobe rule pointing at /bin/false so they cannot be loaded again, and drop the page cache afterward — the exploit lives in cached pages, so clearing them matters. Patched kernels have shipped for most distributions.
Vulnerable without the patch: Ubuntu, Red Hat Enterprise Linux, Debian, openSUSE, CentOS Stream, Gentoo. Already patched: AlmaLinux, Fedora. Not affected: Amazon Linux.
And the general lesson, which costs nothing to adopt: a patch list derived from KEV is an initial-access list. It is very good at the bug that gets an attacker onto the box and much worse at the bug that makes them root once they are there. Every chain has at least two halves. If your vulnerability management program only works on the half with a federal due date attached, you are patching the doorway and leaving the stairs.
Limits
The October campaign details are Dream's research as carried in secondary reporting; we have not independently verified the intrusion and we do not hold indicators from it — no IPs, domains, hashes or file paths have been published that we could ingest, so there is nothing of this campaign in our feed and we are not pretending otherwise. The targeted firewall vendor has not been named publicly and we do not name it here. Attribution is Dream's stated Chinese-nexus assessment, based on target selection across the US, Japan, Taiwan and South Korea; no specific actor is named, by them or by us.
One media note, offered as a caution rather than a complaint: a widely cited May 15 write-up of Fragnesia carries the headline "Exploited in Attacks," and its body reports no observed attacks, victims or incident dates. We nearly repeated that framing from the headline alone. If you are building a timeline for this bug, read the body.
The KEV figures here can be re-pulled by anyone in a minute from CISA's own JSON feed, catalog version 2026.10.27, 1,760 entries, read October 28. Our harvest dates are ours and you cannot check them from outside, which makes them the weakest claim in this post even though they are the one we are most certain of.
Five percent of this is wrong somewhere. It always is.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments