Linux Kernel Fragnesia (CVE-2026-46300): Exploited, Patch Now
Contents8
On 28 October 2026 the US agency CISA added CVE-2026-46300, a flaw in the Linux kernel nicknamed "Fragnesia", to its list of vulnerabilities known to be exploited in real attacks. It is being chained with the PHP flaw "PHP2shell" to take full control (root) of servers.
The fix has been available since May 2026. In other words, servers whose operating system hasn't been updated for almost six months are the ones being hit. This article explains how to check and what to do, step by step.
Key takeaways
- Linux servers still running a kernel older than mid-May 2026 should install the fixed kernel and reboot.
- On its own this flaw does not let attackers in from outside. But once they get in through PHP2shell or another hole, it lets them take over the whole server.
- If you use PHP, update PHP to the fixed version as well.
- The traces of this attack live only in memory, so if you suspect anything, investigate before rebooting.
7.8
CVSS score (High)
3 days
Deadline CISA gave US federal agencies
25 devices
Rooted through the chain with PHP2shell (including in Japan)
Terms used here
Linux kernel = the core of the Linux operating system. Most web servers and business-system servers run on Linux.
root = the most powerful account on a server, able to do anything. Losing root means losing everything: data can be stolen or altered and back doors installed.
Vulnerability = a weak spot in a system that an attacker can use to get in.
What is the flaw, and why is it news now?
Fragnesia is a bug in the networking part of the Linux kernel (the IPsec encryption code). A user or program with ordinary rights on the server can modify files that should be read-only, and use that to gain root.
The flaw was disclosed in May 2026, and a proof of concept was public from the start. It came back into the spotlight in October because of an attack chain like this:
Devices in Japan were hit too
Security firm Dream Research reports that the PHP2shell + Fragnesia chain gave attackers root on 25 devices in the US, Japan, Taiwan and South Korea. The victims were firewall products whose management interface was exposed to the internet. CISA likewise says the flaw "can be chained" with PHP2shell to implant PHP webshells and run commands as root.
As of 31 October there are no reports of ordinary PHP web servers being hit this way. Technically, though, the same chain applies, so this is no reason to relax.
Fixed versions
The upstream Linux fix landed in mid-May 2026. In practice you install the fixed kernel published by your Linux distribution.
| Distribution | Fixed kernel (this or later) | Released |
|---|---|---|
| Amazon Linux 2023 | kernel-6.1.170-213.321.amzn2023 | 15 May 2026 |
| Amazon Linux 2 | kernel-4.14.355-282.729.amzn2 | 15 May 2026 |
| Red Hat Enterprise Linux 9 / AlmaLinux 9 / Rocky Linux 9 | kernel-5.14.0-687.10.1.el9_8 | from 20 May 2026 |
| Red Hat Enterprise Linux 8 / AlmaLinux 8 / Rocky Linux 8 | kernel-4.18.0-553.125.1.el8_10 | from 20 May 2026 |
| Red Hat Enterprise Linux 10 | kernel-6.12.0-211.16.1.el10_2 | 20 May 2026 |
| Ubuntu 24.04 LTS | 6.8.0-124.124 (AWS: 6.8.0-1057.60) | 2 June 2026 |
| Ubuntu 22.04 LTS | 5.15.0-181.191 (AWS: 5.15.0-1109.116) | 4 June 2026 |
| Debian 13 / Debian 12 | 6.12.90-1 / 6.1.174-1 | 23 May / 28 May 2026 |
| Ubuntu 20.04 · 18.04 | Not affected (per Ubuntu) | — |
※ Red Hat says Red Hat Enterprise Linux 7 is not affected. Its standard support has ended, though, so unless you pay for extended support, other flaws will not be fixed. End-of-support dates are collected in "Securing Legacy Systems: Where to Start".
Updating is not enough: you must reboot
A new kernel only takes effect after the server reboots. A server that was "updated but hasn't been rebooted in months" is still running the old kernel. Some distributions (Amazon Linux, Ubuntu and others) offer "livepatch" fixes that apply without a reboot.
Timeline
- Flaw disclosed, with a public proof of concept
- Amazon Linux, Red Hat, Debian, Ubuntu and others release fixed kernels
- Fix released for the PHP flaw "PHP2shell"
- First device rooted through the PHP2shell + Fragnesia chain (per Dream Research)
- CISA adds it to the Known Exploited Vulnerabilities list, with a deadline of just 3 days (31 October)
- JPCERT/CC updates its PHP alert to mention the chain with a Linux kernel flaw
Five steps to check and respond
- List your Linux servers
Websites, business systems, internal file servers and so on. Don't forget servers in the cloud (AWS and others).
- Check the running kernel version
Log in to the server and type
uname -r. If it is older than the version in the table above, it needs updating. - Check for PHP2shell first
If you use PHP and had not applied the 21 October fix, check whether you were broken into. The traces live only in memory and disappear on reboot.
- Update the kernel and PHP, then reboot
At a quiet time, update all operating-system packages and reboot. If you use PHP, update it to the fixed version too.
- Make updates a routine
This time attackers went after servers missing a fix that had been out for six months. Schedule regular operating-system updates and reboots, for example once a month.
Can't reboot right away?
Red Hat suggests that servers not using IPsec (encryption) can block the related modules (esp4, esp6) from loading. Any IPsec-based VPN will stop working, though. Talk to your maintenance vendor before changing the configuration.
Leave it, or act now?
If you leave it
- One small web-app hole can lead to the whole server being taken over
- A back door that survives reboots can be planted
- Damage can spread to other servers in the company
If you update the kernel and reboot
- Even if someone gets in, the damage stays contained
- Other flaws fixed since May are fixed too
- You can tell partners it has been dealt with
Questions to ask your developer, maintenance vendor or hosting provider
- Which Linux distribution do our servers run, and which kernel version is running now?
- When was the operating system last updated and the server rebooted?
- When can you install the kernel fix for CVE-2026-46300 (Fragnesia)?
- If we use PHP: is the PHP2shell fix applied? Have you checked for signs of intrusion?
- How often do you plan to update the operating system and reboot?
How to handle PHP2shell itself is covered in "PHP Vulnerability CVE-2026-109618 (PHP2shell): What to Do Now".
How Digi Dinos can help
Digi Dinos is a software company with offices in Vietnam and Japan. Over 8 years we have delivered more than 150 projects, and our team works in Japanese.
- Server updates and checks: operating system and kernel updates, reboot planning, and checking everything works afterwards.
- Taking over maintenance of existing systems: PHP, Java, Node.js, Python, Ruby, .NET and more.
- Responding to new vulnerabilities: when a fix like this one comes out, we assess the impact and apply it.
- No documentation? No problem: even when the original vendor is gone and nobody understands the system, we read the code, rebuild the documentation and propose a complete plan.
- Lifetime warranty: if a defect turns up in work we did, we fix it, with no time limit for as long as the maintenance contract continues.
Not sure your servers are safe? Free consultation.
From checking the kernel version to planning updates and reboots, even if you can no longer reach whoever set up the server.
Frequently asked questions
Can attackers get in from outside using this flaw alone?
No. Fragnesia raises the privileges of someone who can already run code on the server. Combined with a web-app flaw such as PHP2shell, however, the whole server can be taken over from outside.
We use shared hosting. Do we need to do anything?
On shared hosting the provider normally updates the operating system; check their notices. If you rent your own VPS or cloud server, updating it is your job (or your maintenance vendor's).
Will rebooting take our website or system down?
For a few minutes. Do it at a quiet time and check that the website and business systems work properly afterwards.
How much will it cost?
It depends on how many servers you have and how old their operating systems are. We look at your current setup first, then give you a quote with a clear overall plan.
Sources
- CISA, "CISA Adds Two Known Exploited Vulnerabilities to Catalog" (28 Oct 2026)
- JPCERT/CC, alert on PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (Japanese)
- JPCERT/CC, Weekly Report 2026-05-20 (Japanese)
- Red Hat, CVE-2026-46300
- Ubuntu, CVE-2026-46300
- Amazon Linux Security Center, CVE-2026-46300
- Debian Security Tracker, CVE-2026-46300
- Dream Research, "Chained PHP2Shell Exploit Roots 25 Servers"
Related articles
GitLab CVE-2026-97229 (CVSS 10): Exploited, Patch Now
Brotli Vulnerability CVE-2026-111497 (HTTP2Shell): What to Do
PHP Vulnerability CVE-2026-109618 (PHP2shell): What to Do Now
PHP Upgrade Cost: Moving From PHP 5 or 7 to PHP 8
Taking Over a Legacy System With No Documentation
Node.js Security Release, October 2026: What to Do
Java Vulnerabilities, October 2026: IPA Alert and Licence Changes
Securing Legacy Systems: Where to Start (2026 EOL Guide)
Superior Features of ChatGPT 4o (4 Omni)
What Is Digital Transformation? Definition, Roadmap and Examples
The Secret to Happiness!
What Is an IT Comtor? Role, Skills and How It Differs from a BrSE
