PHP2Shell Plus Fragnesia: CISA Confirms Firewall Takeover Chain

The Cybersecurity and Infrastructure Security Agency (CISA) added a Linux kernel flaw nicknamed "Fragnesia," CVE-2026-46300, to its Known Exploited Vulnerabilities (KEV) catalog on 28 October 2026. The KEV catalog is CISA's list of flaws it has evidence attackers are using in the real world. In the listing, CISA says this flaw can be chained with the two "PHP2Shell" flaws, CVE-2026-109618 and CVE-2026-109619, to plant web shells (small hidden programs that give an attacker a back door through a web page) and run commands as root, the all-powerful administrator account on a Linux system.

What changed. Red Tiger Security covered PHP2Shell when CISA added it to the KEV catalog on 26 October. Fragnesia is a privilege escalation flaw, meaning it lets someone who already has a low-level foothold on a Linux system promote themselves to root. It was disclosed and patched by the major Linux distributions in May 2026, so for most systems the fix has been available for months. What is new is CISA's confirmation that the two are being used together. CISA gave federal civilian agencies until 31 October 2026, just three days, to apply mitigations under Binding Operational Directive (BOD) 26-04, and marked the entry for forensic triage, meaning agencies should check whether a system was already compromised, not just patch it. BOD 26-04 applies only to federal civilian agencies, but CISA encourages every organization to treat KEV entries as top priority.

What the research shows. Dream Research, an Israeli security company, published a report on 26 October describing artifacts it recovered from an attack operation that used this exact chain against internet-facing firewalls from one large vendor, which Dream did not name. According to Dream, the attacker searched for about 19,000 firewalls with their web management page exposed to the internet, narrowed that to 240 targets in the United States, Japan, Taiwan and South Korea, and took full control of 25 systems on 23 and 24 October. Dream reports that two of those firewalls and a central firewall management server belonged to a United States government-affiliated organization, and that the attacker then went after that organization's Active Directory, the directory that holds every user login. Dream does not attribute the activity to a named group, but lists indicators that point to a China-nexus operation. These are Dream's findings, not CISA's, and Red Tiger has not independently confirmed them.

Why this matters for plant owners. The firewall is often the one device that sits between the business network, the internet and the control system network. Many sites still manage their firewalls through a web page, and some of those pages are reachable from the internet so an integrator or a remote engineer can get in. A firewall that an attacker fully controls can quietly let traffic through, hand over the passwords and network map stored in its configuration, and give a path toward historians, engineering workstations and human-machine interfaces (HMIs, the operator screens). The same Linux kernel flaw also matters on the Linux servers and appliances inside the plant, such as historians, remote access gateways and the management servers for data diodes (one-way network devices), because any foothold on those systems can be turned into full control.

Where this shows up, plant floor to cloud. Perimeter and plant firewalls and virtual private network (VPN) gateways that run Linux and PHP under the hood, central firewall management servers, Linux-based historians and data collectors, remote access and jump servers in the demilitarized zone (DMZ, the buffer network between business and control systems), vendor appliances and industrial gateways built on Linux, and any cloud or business system that serves web pages with PHP.

What Red Tiger recommends.

1. Take every firewall, VPN gateway and firewall management web page off the internet this week. Management should only be reachable from a dedicated, trusted management network, and vendor remote access should go through a controlled jump server with multifactor authentication (MFA).
2. Ask each firewall, gateway and appliance vendor whether their product is affected by PHP2Shell or Fragnesia, and apply their fixed release. On Linux servers you manage, install the kernel update from your distribution that addresses CVE-2026-46300, which most distributions released in May 2026.
3. Check before you patch. Look for unexpected files in web folders on firewalls and appliances, admin accounts nobody recognizes, unexpected outbound connections from the firewall itself, and new startup services. If anything looks wrong, treat the device as compromised and rebuild it from a known-good image rather than just patching it.
4. Reset the secrets stored on any firewall that was exposed, including admin, VPN and the Active Directory service account it uses to check logins, and turn on account lockout in Active Directory so passwords cannot be guessed without limit.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources.
CISA KEV listing (28 October 2026): https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog and https://nvd.nist.gov/vuln/detail/CVE-2026-46300
Dream Research (26 October 2026, supporting): https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers

‍