CISA adds a Linux kernel bug already turning PHP hacks into root
CVE-2026-46300, nicknamed Fragnesia, lets a local attacker escalate to root, and researchers say it is already being chained with October's PHP RCE bugs to fully compromise servers.
CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalogue on 28 October: a Linux kernel privilege-escalation bug and a Broadcom VMware ESX logging flaw. The kernel bug gets the harder deadline, federal civilian agencies have until 31 October, tomorrow, to patch it, against 11 November for the VMware one.
The kernel flaw, CVE-2026-46300 and nicknamed Fragnesia, sits in the kernel’s handling of fragmented network packets. It scores CVSS 7.8 and lets a local attacker with low privileges and no user interaction escalate straight to root. It affects kernels released before 13 May 2026; fixes are out in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10, with 7.1 unaffected. BleepingComputer reports attackers are chaining it with the PHP remote-code-execution bugs patched on 21 October, CVE-2026-109618 and CVE-2026-109619, to plant a webshell through PHP and then escalate to root in the same attack, and says the chain has already rooted 25 servers across the US, Japan, Taiwan and South Korea.
Why it matters: if you patched October’s PHP RCE but are still running an older kernel, that patch no longer stops an attacker at a webshell. Check your kernel version against the fixed list now, especially on anything running PHP that hasn’t been rebooted onto a current kernel since.
The caveat: the CISA deadlines bind only US federal agencies. Everyone else just gets to notice both flaws are being exploited in the wild, deadline or not.