Linux kernel flaw chained with PHP2Shell to root firewalls, Dream says

A Linux kernel flaw known as Fragnesia, CVE-2026-46300, lets a local user with low privileges write to the cached copies of read-only files and gain root, Red Hat says. CISA added it to its KEV catalog on Oct 28, saying it can be chained with the PHP2Shell flaws in PHP to implant web shells and run commands as root. Dream said on Oct 26 that attackers used that chain to root 24 firewalls and a firewall management server. Fixed stable kernels include 6.12.91 and 6.18.33.

The kernel’s CVE record says the flaw is in how socket buffers that share memory pages are merged. That can lead the kernel’s IPsec ESP code to decrypt data in place over cached file pages. Red Hat calls it a variant of the Dirty Frag flaw and rates it important. It affects kernels from 3.9 until the fixed stable releases. CISA asks federal agencies to fix it by Oct 31.

Dream says its researchers found the attackers’ tools, target lists and logs on Oct 25. The attackers used a custom PHP2Shell exploit to run commands as an unprivileged user through the firewalls’ exposed management interfaces. They then used Fragnesia to overwrite a login configuration file and become root. Dream hasn’t named the firewall vendor or the affected versions, and says it notified the vendor.

Dream says the attackers found about 19,000 firewalls with exposed management interfaces and picked 240 in the US, Japan, Taiwan and South Korea. Two of the 24 they rooted belonged to a US government-affiliated organization, where the attackers reached an internal firewall management server and went after Active Directory. Dream doesn’t attribute the attacks to a named group, though it lists signs of a Chinese-nexus operation.