PolicyCortex
Request Access
Summary
  • CISA lists a Linux kernel flaw as exploited, with a due date of October 31, 2026.
  • The flaw chains with PHP flaws to plant webshells and run commands as root.
  • Fixed kernel builds start at 5.10.257 and run through 7.1 and later.
  • Reboot after patching, then record the running kernel version as proof.

What CISA listed

The Cybersecurity and Infrastructure Security Agency (CISA) added a Linux kernel flaw to a catalog on October 28, 2026. The catalog is the Known Exploited Vulnerabilities (KEV) catalog. A KEV listing means CISA has evidence of active exploitation. The record is CVE-2026-46300. Common Vulnerabilities and Exposures (CVE) is the record system for public flaws. The KEV name is Linux Kernel Missing Initialization of a Variable Vulnerability. The score is 7.8 under Common Vulnerability Scoring System (CVSS) version 3.1. The weakness type is Common Weakness Enumeration (CWE) 456.

What the flaw does

The flaw fails to preserve a shared fragment marker during socket buffer coalescing. That failure can allow unintended change to page cache backed data. It can cause Encapsulating Security Payload (ESP) input processing to decrypt shared fragments in place. CISA lists a due date of October 31, 2026. Federal civilian agencies must complete forensic triage by that date under Binding Operational Directive (BOD) 26-04. CISA states ransomware campaign use is unknown.

The chain that was reported

Researchers at Dream reported a chained attack on October 28, 2026. A suspected China linked actor chained PHP2Shell with Fragnesia. The attacks hit 25 servers on October 23 and 24, 2026. The targets included systems in a United States government affiliated environment. Credential extraction and Active Directory enumeration were reported. Dream did not name a firewall vendor in this report. Do not read the 25 servers as one vendor product.

Palo Alto Networks issued a separate vendor advisory. It states active exploitation has been observed for CVE-2026-109618 and CVE-2026-109619. The targets were management interfaces exposed to the internet. Risk is highest when management access is allowed from external internet addresses. The advisory says to restrict management access to trusted internal addresses. Palo Alto Networks did not link its report to the Dream report. Treat them as two separate reports about a shared chain. CISA states the flaw chains with CVE-2026-109618 and CVE-2026-109619 to plant PHP webshells and run commands as root.

What to patch

Kernel builds, fixed releases:

  • 5.10 line: use 5.10.257 or later.
  • 5.15 line: use 5.15.208 or later.
  • 6.1 line: use 6.1.174 or later.
  • 6.6 line: use 6.6.141 or later.
  • 6.12 line: use 6.12.91 or later.
  • 6.18 line: use 6.18.33 or later.
  • 7.0 line: use 7.0.10 or later.
  • 7.1 line: use 7.1 or later.

Vendor and distro builds may carry their own fixed build numbers. Check the build your vendor ships, not only the upstream number. Reboot after the patch so the new kernel runs. A patched file on disk is not proof until the running kernel changes.

PHP2Shell patches arrived on October 21, 2026. Use PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 for your line. The KEV due date for CVE-2026-109618 and CVE-2026-109619 falls on October 29, 2026.

The governance lesson

A kernel flaw plus a web flaw can form one path to root. Patching one half of a chain leaves the other half open. Your inventory must list every Linux host and its running kernel version. Your inventory must also list every PHP host and its PHP version. Record the version before and after each patch. Record the reboot and the scan result after the patch. A ticket marked done with no running version is a claim. PolicyCortex does not patch the kernel or PHP. PolicyCortex helps teams link proof to requirements.

Sources

Next step

Patch the kernel and PHP to fixed builds, reboot, and record the running versions.

Questions on this record
What is Fragnesia?
Fragnesia is the name for this Linux kernel flaw.
Which kernel builds are fixed?
Fixed releases start at 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, and 7.1.
Is ransomware use confirmed?
No. CISA states ransomware campaign use is unknown.
What is the due date?
The KEV due date is October 31, 2026.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Further reading in this register

  1. Veeam Backup Flaw Lets an Attacker Bypass AuthorizationVeeam fixes a 9.1 authorization bypass in Backup and Replication 13. Patch to a fixed build and record the build number.4 min
  2. Adobe Commerce Upload Flaw Joins the Exploited ListCISA added the Adobe Commerce upload flaw to its exploited list on October 27, 2026. Stores must patch to the July 2026 build and hunt for planted code.4 min
  3. Jackson Databind 9.8 Flaw Bypasses Its Own Type CheckA new Jackson flaw scores 9.8. It bypasses a recent fix. Upgrade to a fixed build now.4 min

Verify the record this entry describes.

Request AccessBook a call
Published
Last updated
Unchanged since publication
Author
Leonard Esere