PHP2Shell plus Fragnesia: A dangerous new route from web server to root

Publisher excerpt From CSO Online

The PHP2Shell saga continues, with attackers discovering new ways to exploit the critical vulnerability impacting millions of organizations worldwide. The US Cybersecurity and Infrastructure Security Agency (CISA) has warned of a high severity Linux kernel privilege escalation flaw that attackers are chaining with PHP2Shell bugs in the wild. Identified as CVE-2026-46300, it could allow attackers to run malicious code with root permissions, giving them unrestricted ability to run commands, tamper with system settings, view, edit, or delete files, and perform other malicious actions. Once attackers establish root access, they can perform any action on a server including, but not limited to, disabling the server, creating accounts, removing accounts, connecting to other servers, and adding/removing software, explained Scott Miserendino, CTO at security and compliance platform DataBee. “PHP2Shell allows for remote access, but that access is typically limited by the account used to run the PHP service,” he said. “By chaining with CVE-2026-46300, that attacker can get unlimited access.” Researchers at Dream Security have discovered that this attack has already been used to breach 25 servers, including three affiliated with the US government. Federal agencies have been ordered to patch the flaw, which is known as Fragnesia. Anatomy of an attack PHP is a widely-used, open source server-side scripting language that serves as the backbone for websites like WordPress, which pow…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.