The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
PHP2Shell plus Fragnesia: A dangerous new route from web server to root
- Published
- Record updated
Summary
CISA has warned of CVE-2026-46300, a high severity Linux kernel privilege escalation flaw, known as Fragnesia and part of the Dirty Frag class of local privilege escalation bugs, that attackers are chaining with PHP2Shell bugs in the wild. Researchers at Dream Security said the attack has been used to breach 25 servers, including three affiliated with the US government. Threat actors reportedly rooted vulnerable PAN-OS Palo Alto Networks firewalls and then targeted Active Directory.
Mitigation
Federal agencies have been ordered to patch the flaw. No further mitigation is specified in the source.