[{"data":1,"prerenderedAt":238},["ShallowReactive",2],{"seo-verification":3,"blog-fragnesia-cve-2026-46300-linux-kernel-php2shell-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-fragnesia-cve-2026-46300-linux-kernel-php2shell-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":165,"ctaBody":166,"ctaButton":167,"ctaUrl":168,"relatedPosts":169},524,"fragnesia-cve-2026-46300-linux-kernel-php2shell",{"fr":12,"en":10,"ar":13,"es":14},"fragnesia-cve-2026-46300-noyau-linux-php2shell","ثغرة-fragnesia-cve-2026-46300-نواة-لينكس-php2shell","fragnesia-cve-2026-46300-kernel-linux-php2shell","Fragnesia CVE-2026-46300: patch the Linux kernel (PHP2Shell)","Fragnesia (CVE-2026-46300), chained with PHP2Shell, leads to root. Fixed kernels by distribution, esp4\u002Fesp6\u002Frxrpc workaround, checks and traces.",10,0,false,"2026-10-29T00:00:00+00:00","2026-10-29T15:45:55+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Ffragnesia-cve-2026-46300-noyau-linux-php2shell-poster.svg","On October 28, 2026, CISA added CVE-2026-46300, nicknamed Fragnesia, to its catalog of exploited vulnerabilities. The Linux kernel flaw dates from May and so does its fix, but it is urgent again: chained with PHP2Shell, it turns a compromised PHP site into a fully compromised server, and therefore into every client site it hosts. This guide shows how to tell in ten minutes which servers still run a vulnerable kernel, how to update by distribution, which workaround to use if the reboot must wait, and which traces to look for.",[35,39,48,51,91,94,116,134,137,152,156,159,162],{"type":36,"title":37,"body":38},"h2","Fragnesia in short: a May flaw that is urgent again","Fragnesia is the name given to CVE-2026-46300, a Linux kernel flaw disclosed on May 13, 2026 with a public proof of concept. The defect fits in one sentence: the `skb_try_coalesce()` function loses the marker that flags a shared fragment, so ESP decryption runs in place on page cache pages. An unprivileged process can then modify, in memory, a file that is supposed to be read-only, such as `\u002Fusr\u002Fbin\u002Fsu`, and gain root. The CVSS 3 score is 7.8, and Ubuntu rates the flaw High priority. Fixes have existed since May: AlmaLinux put them into production on May 16, 2026. What changes at the end of October 2026 is the context, because CISA listed the flaw in its catalog of exploited vulnerabilities on October 28, 2026.",{"type":40,"title":41,"items":42},"ul","The essentials before opening a terminal",[43,44,45,46,47],"**Local, not remote** — Fragnesia cannot be attacked from the internet: the attacker must already run code on the machine. It is the step that follows a web intrusion.","**Running kernel, not installed kernel** — an up-to-date package protects nothing until the machine has rebooted onto it.","**Fixed kernels exist** — Ubuntu, Debian, AlmaLinux and CloudLinux have published their versions; the table below lists them.","**A workaround exists, at a price** — blocking three modules (esp4, esp6, rxrpc) closes the path, but it breaks IPsec and AFS.","**A bridge, not a solution** — the workaround holds until the reboot onto the fixed kernel, not beyond.",{"type":36,"title":49,"body":50},"Why PHP2Shell changes the schedule","A local privilege escalation does not trigger on its own: it first needs an entry point. On an agency server, the entry point is easy to find, a PHP site. PHP2Shell names two flaws in the interpreter, CVE-2026-109618 and CVE-2026-109619, that allow code execution without authentication. The webshell then runs under the site's account, without privileges. Fragnesia is the next step: it turns that account into root. The company Dream reports having observed this combination in a campaign targeting firewalls; this is the account of a single vendor, which CISA does not confirm. On CISA's side, CVE-2026-46300 is in the catalog with a due date of October 31, 2026 and a forensic triage requested from US agencies. Above all, remember this: fixing PHP closes the entry, not the escalation. A server visited before the PHP fix stays dangerous until its kernel is up to date. The PHP2Shell guide linked below this article covers the first part.",{"type":52,"title":53,"headers":54,"rows":58},"comparison","Fixed kernels by distribution",[55,56,57],"Distribution","Fixed kernel (or newer)","Good to know",[59,63,67,71,75,79,83,87],[60,61,62],"Ubuntu 22.04 LTS","5.15.0-181.191","`uname -r` shows 5.15.0-181-generic",[64,65,66],"Ubuntu 24.04 LTS","6.8.0-124.124","`uname -r` shows 6.8.0-124-generic",[68,69,70],"Ubuntu 25.10 and 26.04 LTS","6.17.0-35.35 and 7.0.0-22.22","One version per release; 26.10 is not affected",[72,73,74],"Debian 12 (bookworm)","6.1.190-1","Security repository; `uname -v` shows the package version",[76,77,78],"Debian 13 (trixie)","6.12.113-1","Security repository; same reading with `uname -v`",[80,81,82],"AlmaLinux 8, 9 and 10","4.18.0-553.124.3.el8_10 ; 5.14.0-611.54.5.el9_7 ; 6.12.0-124.56.3.el10_1","In production since May 16, 2026",[84,85,86],"CloudLinux 7h and 8","4.18.0-553.124.3.lve.el7h ; 4.18.0-553.124.3.lve.el8","CloudLinux 9 and 10 reuse the AlmaLinux kernels; check the rollout channel",[88,89,90],"Not affected","Ubuntu 20.04 LTS and earlier, CloudLinux 7","Nothing to fix on these versions",{"type":36,"title":92,"body":93},"An installed kernel is not the running kernel","This is the trap that turns \"everything is up to date\" into a server that is still vulnerable. Installing a kernel package drops new files into `\u002Fboot`, but the kernel in memory remains the one from the last boot. Until the machine reboots, `apt` or `dnf` can report an up-to-date system while `uname -r` still answers with the old number. This is common across a fleet for a simple reason: nobody likes rebooting a server that carries client sites, so the reboot waits. Two reference points avoid confusion. On Ubuntu, the number in the table has two parts: 5.15.0-181.191 corresponds to `5.15.0-181-generic` in `uname -r`. On Debian, `uname -r` shows the kernel ABI, not the package version; `uname -v` displays the full version, for example \"Debian 6.1.190-1\".",{"type":95,"title":96,"steps":97},"steps","Check a server's exposure in ten minutes",[98,101,104,107,110,113],{"title":99,"body":100},"Read the running kernel","`uname -r` then `uname -v`. Note the result machine by machine: it is the only value that counts, not the one from the package manager. Compare it to the table above.",{"title":102,"body":103},"List the installed kernels","Debian and Ubuntu: `dpkg -l 'linux-image*'`. AlmaLinux and CloudLinux: `rpm -q kernel`. If a fixed kernel is installed but `uname -r` shows another number, the server has not rebooted: it is exposed.",{"title":105,"body":106},"Spot pending reboots","On AlmaLinux and CloudLinux, `sudo needs-restarting -r` tells you whether a reboot is needed. On Ubuntu, the presence of the file `\u002Fvar\u002Frun\u002Freboot-required` signals the same thing.",{"title":108,"body":109},"Look at the modules involved","`lsmod | grep -E 'esp4|esp6|rxrpc'`. An empty result does not make the server safe: a module that is absent can load on demand. It only says it is not loaded at this moment.",{"title":111,"body":112},"Check rxrpc on AlmaLinux 9 and 10","`rpm -q kernel-modules-partner`. On these two versions, the rxrpc module is exposed only if this package is installed; AlmaLinux 8 does not build this module.",{"title":114,"body":115},"Spot the VPN gateways","`systemctl list-units | grep -Ei 'strongswan|libreswan|ipsec'`. List the machines that terminate or carry IPsec tunnels, or that use AFS: the workaround below is not suitable for them.",{"type":95,"title":117,"steps":118},"Update the kernel, by environment",[119,122,125,128,131],{"title":120,"body":121},"Debian and Ubuntu","`sudo apt update && sudo apt full-upgrade` then `sudo reboot`. We use `full-upgrade` because a new kernel arrives as a new package, which `upgrade` alone can leave aside.",{"title":123,"body":124},"AlmaLinux and other RHEL","`sudo dnf clean metadata && sudo dnf upgrade` then `sudo reboot`. After the reboot, `rpm -q kernel` must list a kernel at least equal to the one in the table.",{"title":126,"body":127},"CloudLinux","On CloudLinux 9 and 10, the AlmaLinux kernels apply: same command as above. On CloudLinux 7h and 8, the fixed kernel is a CloudLinux kernel distributed by channel; the CloudLinux article, linked at the end of the page, says whether your channel offers it. Then `sudo yum update 'kernel*'`, then `sudo reboot`.",{"title":129,"body":130},"Docker containers","A container has no kernel of its own: it uses the host's. Rebuilding an image fixes nothing here, whereas updating the host and rebooting it protects all its containers at once. Ubuntu also mentions a possible container escape: do not put this off. The PHP images to rebuild for PHP2Shell belong to another guide.",{"title":132,"body":133},"Check after the reboot","`uname -r` (and `uname -v` on Debian) must show a number equal to or higher than the one in the table. Then run `sudo systemctl --failed` to spot the services that did not come back.",{"type":36,"title":135,"body":136},"Workaround or kernel: the choice depends on the server's role","Rebooting cuts the sites, and the objection is legitimate. The workaround exists for that: it blocks the loading of esp4, esp6 and rxrpc, the three modules the flaw goes through, without a reboot. Its price is precise. ESP is the encryption protocol of IPsec and rxrpc serves AFS; if the server terminates or carries IPsec tunnels (strongSwan, Libreswan) or mounts AFS, the workaround breaks them, and AlmaLinux says so plainly. A simple rule: on a web server without VPN, apply the workaround now, then the kernel at the next slot; on a VPN gateway, fixed kernel on a reboot slot, without the workaround. In both cases, the workaround is only a bridge until the reboot onto the fixed kernel. AlmaLinux also states that the workaround published for Dirty Frag already covers Fragnesia: if it is in place, there is nothing to add.",{"type":95,"title":138,"steps":139},"Apply the workaround, check it, undo it",[140,143,146,149],{"title":141,"body":142},"Write the file and unload the modules","`sudo sh -c \"printf 'install esp4 \u002Fbin\u002Ffalse\\ninstall esp6 \u002Fbin\u002Ffalse\\ninstall rxrpc \u002Fbin\u002Ffalse\\n' > \u002Fetc\u002Fmodprobe.d\u002Ffragnesia.conf; rmmod esp4 esp6 rxrpc 2>\u002Fdev\u002Fnull; true\"`\nThe command creates `\u002Fetc\u002Fmodprobe.d\u002Ffragnesia.conf`, which forbids loading the three modules, then unloads the ones that were loaded.",{"title":144,"body":145},"Check","`lsmod | grep -E 'esp4|esp6|rxrpc'` must return nothing. The workaround survives a reboot as long as the file exists.",{"title":147,"body":148},"Drop the page cache if the machine may have been targeted","`sudo sh -c \"echo 3 > \u002Fproc\u002Fsys\u002Fvm\u002Fdrop_caches\"`. Binaries are reloaded from disk. If you want to keep evidence, run the checks of the next section first.",{"title":150,"body":151},"Undo the workaround","Once the machine has rebooted onto the fixed kernel: `sudo rm \u002Fetc\u002Fmodprobe.d\u002Ffragnesia.conf`. If a Dirty Frag workaround was already in place under another file name, it follows its own cycle.",{"type":153,"title":154,"body":155},"tip","KernelCare, for servers that cannot be rebooted","If the server uses KernelCare (live kernel patching), `kcarectl --update` applies the fix without a reboot, and `kcarectl --patch-info | grep CVE-2026-46300` confirms it is present. CloudLinux reports a complete rollout for the AlmaLinux ELS and FIPS variants, the EL8 family, Debian 11 and 12 and Ubuntu Jammy, without explicitly naming standard CloudLinux 9 and 10. Do not generalize: check per distribution, and if the command returns nothing, fall back on the workaround or on the kernel.",{"type":36,"title":157,"body":158},"Look for traces before rebooting","A server patched since May is not concerned; a server that has never rebooted is, and if it has carried a vulnerable PHP site, it may have been visited. The alteration happens in the page cache: it does not necessarily write to disk, and a reboot or `drop_caches` erases it. So run your checks first. Three leads. Recent `.php` files under the web roots: `sudo find \u002Fvar\u002Fwww \u002Fhome -name '*.php' -mtime -7 -type f`, to adapt to your paths. Unexpected setuid binaries: `sudo find \u002F -xdev -perm -4000 -type f -mtime -30`. Package integrity: `rpm -V util-linux` on the RHEL family, `sudo debsums -s util-linux` on Debian and Ubuntu after `apt install debsums`; the util-linux package provides `\u002Fusr\u002Fbin\u002Fsu`, the target cited by AlmaLinux. A suspicious result is not cleaned up by hand: isolate the machine and treat it as compromised.",{"type":36,"title":160,"body":161},"For an agency: one common slot, not one server at a time","Time is not lost in the command, but in knowing which machine carries which clients, which one is a VPN gateway and when it can reboot. Build a table per server: running kernel, installed kernel, role (web, VPN, database), workaround applied or not. Then sort into three batches: simple web servers, immediate workaround then kernel at the slot; gateways, kernel at the slot without the workaround; machines already up to date, a simple check of the running kernel. Warn clients once, on a common slot, rather than machine by machine. The reboot method for a VPS that carries client sites is detailed in the PwnEscape and Vghost guide linked below this article, no need to repeat it here. This guide is provided as is: administering your servers remains your responsibility, with no support from us.",{"type":36,"title":163,"body":164},"The official documentation","Ubuntu page for CVE-2026-46300: https:\u002F\u002Fubuntu.com\u002Fsecurity\u002FCVE-2026-46300\n\nDebian security tracker: https:\u002F\u002Fsecurity-tracker.debian.org\u002Ftracker\u002FCVE-2026-46300\n\nAlmaLinux notice on Fragnesia: https:\u002F\u002Falmalinux.org\u002Fblog\u002F2026-05-13-fragnesia-cve-2026-46300\u002F\n\nCloudLinux article (kernels and KernelCare): https:\u002F\u002Fblog.cloudlinux.com\u002Ffragnesia-mitigation-and-kernel-update\n\nCISA alert of October 28, 2026: https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F10\u002F28\u002Fcisa-adds-two-known-exploited-vulnerabilities-catalog\n\nSecurityWeek report on the PHP2Shell chain: https:\u002F\u002Fwww.securityweek.com\u002Fchina-linked-hackers-exploit-php2shell-to-root-firewalls\u002F\n\nUpstream fix in the kernel: https:\u002F\u002Fgit.kernel.org\u002Flinus\u002Ff84eca5817390257cef78013d0112481c503b4a3","A fleet of sites to patch in a single slot","A fleet of client sites is easier to patch when the machines are grouped and visible in one place: one common slot, one table. The client relationship stays with the agency, the infrastructure with ServOrbit.com.","Discover the agency offer","\u002Fsolutions\u002Fagences",[170,186,203,222],{"id":171,"slug":172,"slugs":173,"title":177,"excerpt":178,"readTime":179,"views":18,"isPinned":19,"publishedAt":180,"updatedAt":181,"category":182,"categories":183,"featuredImage":30,"bgImage":31,"posterImage":185,"relatedSolution":30},517,"pwnescape-vghost-linux-kernel-vps-update",{"fr":174,"en":172,"ar":175,"es":176},"pwnescape-vghost-noyau-linux-vps-mettre-a-jour","ثغرتا-pwnescape-و-vghost-تحديث-نواة-لينكس-على-vps","pwnescape-vghost-kernel-linux-vps-actualizar","PwnEscape and Vghost: update the Linux kernel on your VPS","Two Linux kernel flaws from October 2026: PwnEscape is fixed by your host, Vghost on your VPS. Check the kernel, update it and schedule the reboot.",11,"2026-10-28T00:00:00+00:00","2026-10-29T03:10:22+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[184],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fpwnescape-vghost-noyau-linux-vps-mettre-a-jour-poster.svg",{"id":187,"slug":188,"slugs":189,"title":193,"excerpt":194,"readTime":195,"views":196,"isPinned":19,"publishedAt":197,"updatedAt":198,"category":199,"categories":200,"featuredImage":30,"bgImage":31,"posterImage":202,"relatedSolution":30},489,"php2shell-cve-2026-109618-109619-patch-php",{"fr":190,"en":188,"ar":191,"es":192},"php2shell-cve-2026-109618-109619-mettre-a-jour-php","php2shell-cve-2026-109618-109619-تحديث-php","php2shell-cve-2026-109618-109619-actualizar-php","PHP2Shell: patch CVE-2026-109618 and CVE-2026-109619","PHP2Shell: two critical PHP flaws exploitable without an account. Patched versions, update commands per system and temporary mitigations.",16,1,"2026-10-22T00:00:00+00:00","2026-10-27T23:58:43+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[201],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fphp2shell-cve-2026-109618-109619-mettre-a-jour-php-poster.svg",{"id":204,"slug":205,"slugs":206,"title":210,"excerpt":211,"readTime":212,"views":18,"isPinned":19,"publishedAt":213,"updatedAt":214,"category":215,"categories":216,"featuredImage":30,"bgImage":31,"posterImage":218,"relatedSolution":219},501,"php2shell-docker-rebuild-php-wordpress-images",{"fr":207,"en":205,"ar":208,"es":209},"php2shell-docker-wordpress-reconstruire-images-php","php2shell-docker-إعادة-بناء-صور-php-ووردبريس","php2shell-docker-reconstruir-imagenes-php-wordpress","PHP2Shell and Docker: rebuild your PHP and WordPress images","An updated WordPress or Laravel does not change the PHP in your Docker image. Prove the served version, spot which tags moved and rebuild without traps.",12,"2026-10-23T00:00:00+00:00","2026-10-23T23:43:01+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[217],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fphp2shell-docker-wordpress-reconstruire-images-php-poster.svg",{"categorySlug":220,"appSlug":221},"cms-websites","wordpress",{"id":223,"slug":224,"slugs":225,"title":229,"excerpt":230,"readTime":17,"views":231,"isPinned":19,"publishedAt":232,"updatedAt":233,"category":234,"categories":235,"featuredImage":30,"bgImage":31,"posterImage":237,"relatedSolution":30},382,"vps-automatic-security-updates-debian-ubuntu",{"fr":226,"en":224,"ar":227,"es":228},"securite-vps-mises-a-jour-automatiques-debian-ubuntu","تحديثات-أمان-تلقائية-vps-debian-ubuntu","actualizaciones-seguridad-vps-debian-ubuntu","Automatic Security Updates on Debian\u002FUbuntu VPS","Configure unattended-upgrades on your Debian\u002FUbuntu VPS to automate security patches and reduce attack surface across your client fleet.",2,"2026-09-26T00:00:00+00:00","2026-09-29T14:40:42+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[236],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fsecurite-vps-mises-a-jour-automatiques-debian-ubuntu-poster.svg",1793289222988]