PHP2Shell Plus a Linux Flaw Is Now Taking Over Firewalls: What to Check

Last week we wrote about PHP2Shell, a pair of critical PHP flaws that let an attacker run code on a web server without logging in. There is an important update. On October 28, 2026, CISA added a Linux kernel flaw called Fragnesia (CVE-2026-46300) to its list of vulnerabilities known to be exploited, and said attackers can chain it with PHP2Shell "to implant PHP webshells and run commands as root."

In plain terms: PHP2Shell gets an attacker a foot in the door, and Fragnesia turns that into full control of the device.

The short version: make sure your firewall's management page can't be reached from the internet, install your firewall vendor's latest updates, and have your Linux servers and appliances updated for both PHP2Shell and Fragnesia.

What researchers found

In an October 26, 2026 report, the security research firm Dream described a campaign that used the two flaws together against firewalls from one large vendor, which it chose not to name while the vendor works on the issue. According to the report:

• The attacker searched the internet for about 19,000 of these firewalls whose management interfaces were exposed online.
• They narrowed that to 240 targets and took full control of 24 firewalls, plus one internal firewall management server reached through one of them, for 25 systems in the United States, Japan, Taiwan and South Korea.
• The whole chain, from a single unauthenticated web request to a hidden root webshell, took under 15 minutes.
• On most of the firewalls the attacker simply left a webshell behind to come back later. At one organization they went further: they built a tunnel into the internal network, pulled a stored directory account password from the firewall configuration, listed every user and group in Active Directory, and tried password spraying, which the report notes was helped by the domain having no account lockout.

What Fragnesia is

Red Hat describes Fragnesia as a Linux kernel flaw in the IPsec networking code that lets someone who already has a low-privilege foothold on a system gain root, the highest level of access. It is part of a group of related kernel flaws called "Dirty Frag." Red Hat rates it Important rather than Critical because on its own it needs local access. Chained with PHP2Shell, that local access is no longer hard to get. Red Hat and other Linux vendors have released fixed kernels.

Who is at risk

• Firewalls, VPN gateways and other network appliances whose web management page is reachable from the internet, especially ones that run PHP and Linux underneath.
• Linux web servers and hosting panels running a PHP version affected by PHP2Shell on an unpatched kernel.
• Other Linux-based devices in the office, such as storage boxes or camera recorders, if they run PHP and are exposed to the internet.

What to do this week

1. Take firewall management off the internet. The management page should only be reachable from inside your network or through your VPN. Dream notes the whole campaign started from management interfaces that should never have been exposed to the internet.
2. Install your firewall vendor's latest updates and watch for any advisory about PHP2Shell or Fragnesia from them.
3. Update Linux servers. Install the fixed kernel from your Linux vendor and reboot, and update PHP to a fixed release (8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later). If a kernel update has to wait, Red Hat's bulletin lists temporary workarounds.
4. Look for signs of a break-in. Ask your IT provider to check exposed devices for unfamiliar files in web folders, unexpected scheduled tasks or services, and outbound connections you don't recognize. If a device was exposed and unpatched, treat it as possibly compromised and change the passwords stored on it.
5. Tighten Active Directory. Turn on account lockout after repeated failed sign-ins, make sure service accounts used by firewalls and VPNs have strong passwords and only the access they need, and keep multifactor sign-in on remote access.

Questions to ask your IT provider

1. Can our firewall's management page be reached from the internet?
2. Is our firewall on its vendor's latest version, and has the vendor said anything about PHP2Shell or Fragnesia?
3. Are our Linux servers and appliances patched for CVE-2026-46300 and PHP2Shell?
4. Do we have account lockout turned on in Active Directory?