The US Cybersecurity and Infrastructure Security Agency (CISA) has warned that a high-severity Linux kernel privilege escalation flaw, CVE-2026-46300 (named Fragnesia), is being chained with the PHP2Shell bugs (CVE-2026-109618 and CVE-2026-109619) to give attackers root access on compromised servers. Researchers at Dream Security observed the combined attack on 25 servers, including three linked to the US government, and demonstrated how it can compromise Palo Alto Networks firewalls running vulnerable PAN-OS builds in a single unauthenticated HTTP request. Once root is obtained, threat actors can disable servers, create or remove accounts, access Active Directory, extract credentials, and park firewalls across the US, Japan, Taiwan and South Korea. The PHP bugs provide code execution as the web-service account, while the kernel bug writes its payload into the page cache, bypassing disk-based integrity checks. 1