Die Linux-Kernel-Lücke Fragnesia wird seit Oktober angegriffen, zusammen mit PHP2Shell. Der Fix ist seit Mai da, wirkt aber erst nach einem Neustart. So prüfen Sie es.

Attackers exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the Fragnesia bug to root firewalls.

Attackers exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the Fragnesia bug to root firewalls.

Les failles PHP2Shell et Fragnesia (noyau Linux) sont exploitées ensemble pour obtenir un accès root sur 24 firewalls. L'agence CISA a publié une alerte.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild. [...]

Attackers exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the Fragnesia bug to root firewalls.

Dream: PHP2Shell + Fragnesia rooted 24 firewalls plus 1 management server (25 devices); China-nexus assessed; three CVEs in CISA KEV.

CISA warns attackers chain a Linux kernel escalation bug with PHP2Shell to run code as root on firewalls and government networks.

Attackers exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the Fragnesia bug to root firewalls.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild.

Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things.

Fragnesia (CVE-2026-46300) and the PHP2Shell flaws are being exploited. What they are, who is affected and how to patch your Linux and PHP servers.

CISA added Fragnesia (CVE-2026-46300) to its Known Exploited Vulnerabilities catalog on October 28, 2026, warning it is chained with PHP2Shell to gain root on Linux servers. Dream Security documented 25 compromised servers across four countries, with conflicting reports on two or three U.S. governme

Introduction: Recent emergency warnings from the Cybersecurity and Infrastructure Security Agency (CISA) highlight active, in-the-wild exploitation of two critical server-level vulnerabilities by advanced threat groups and ransomware syndicates. The flaws—identified as CVE-2026-41709 in VMware ESX and CVE-2026-46300 ("Fragnesia") in the Linux kernel—enable stealthy audit log manipulation and immediate local privilege escalation to root. Together, these vulnerabilities provide sophisticated attackers with the vectors needed to silently compromise and seize complete control of core enterprise server environments.

TL;DR Security researchers uncovered an espionage campaign that used a custom PHP2Shell exploit to gain root access on 25 firewall servers across the Pacific region. By pairing this PHP2Shell exploit Fragnesia privilege escalation chain into a single unauthenticated request, the attacker breached a U.S. government-affiliated network. From there, the intruder pivoted to an internal management server and extracted Active Directory credentials.

Researchers say attackers combined PHP RCE with a Linux kernel flaw to root vulnerable firewall appliances, establish persistence, and extract credentials, private keys, and full network topology.

{{rh9e7yNRO}}

The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization. The post China-Linked Hackers Exploit PHP2Shell to Root Firewalls appeared first on SecurityWeek.