# MSP Threat Briefing: October 29, 2026

_October 29, 2026 · LNX Inc._

CISA lists Fragnesia, a Linux kernel flaw chained with PHP2Shell to get root on firewalls. Federal deadline is October 31. ConnectWise starts restores.

PHP2Shell now has a second stage. CISA added Fragnesia, a Linux kernel privilege escalation flaw, to its exploited list on October 28. Attackers are using it to turn a PHP2Shell foothold into root. Federal agencies have until October 31, two days from now.

1. Update the kernel on every Linux server that runs PHP, starting with internet-facing ones. Reboot into the new kernel.
2. Ask your firewall, VPN and appliance vendors whether their firmware is affected by CVE-2026-46300, and take management interfaces off the internet.
3. Confirm the PHP2Shell fixes are in place. The federal deadline for those is today.
4. For ConnectWise Cloud Backup, re-authorize Microsoft 365 tenants with the new app as ConnectWise instructs, and keep the old app connections disabled.

## 1. Update: Fragnesia lets PHP2Shell attackers become root

This follows the PHP2Shell items in the [October 26](/news/msp-threat-briefing-2026-10-26/) and [October 27](/news/msp-threat-briefing-2026-10-27/) briefings. CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog on October 28 ([CISA alert](https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog)). The [catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300) says it can be chained with CVE-2026-109618 and CVE-2026-109619 "to implant PHP webshells and run commands as root." The federal due date is October 31, and CISA flags it for forensic triage.

Fragnesia is a local privilege escalation in the kernel's XFRM ESP-in-TCP code. It lets a local user write into the in-memory copy of read-only files. The files on disk do not change, so a reboot erases both the change and the evidence. It was [disclosed on oss-security](https://www.openwall.com/lists/oss-security/2026/05/13/3) on May 13, 2026, with a public exploit, and major distributions have shipped fixes since. The new part is confirmed use in attacks.

The attack chain comes from Dream Research's [October 26 report](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers). Dream says an operator it ties to China used a custom PHP2Shell exploit against the PHP-based management server on one vendor's firewalls. The operator then used Fragnesia to edit `/etc/pam.d/su` in memory so `su root` asked for no password. Dream counts 25 rooted systems: 24 firewalls and one internal firewall management server, including a US government-affiliated network. From that server the operator read an LDAP service account password and listed domain users and groups.

Dream does not name the firewall vendor and says the vendor has been notified. The claims have not been independently confirmed, and Dream published no IP addresses or hashes.

**Who is exposed.** Any client with a Linux server running PHP that has not had a kernel update since May: web servers, WordPress and Magento hosts, intranet apps and Nextcloud boxes. Also exposed are appliances built on Linux and PHP whose management page faces the internet. Ubuntu lists [20.04 and older as not affected](https://ubuntu.com/security/CVE-2026-46300) on its standard kernels.

**What to do.**

- Update the kernel and reboot. Fixed Ubuntu packages are `linux` 7.0.0-22.22 (26.04), 6.8.0-124.124 (24.04) and 5.15.0-181.191 (22.04); cloud kernels have their own versions on the [Ubuntu page](https://ubuntu.com/security/CVE-2026-46300). Debian fixed it in DSA-6306-1 (bookworm, 6.1.174-1) and DSA-6295-1 (trixie, 6.12.90-1), per the [Debian tracker](https://security-tracker.debian.org/tracker/CVE-2026-46300). For other distributions, check the vendor's tracker for CVE-2026-46300.
- Fragnesia is a separate bug from the earlier Dirty Frag flaws (CVE-2026-43284, CVE-2026-43500). A kernel patched for Dirty Frag is not proof of a Fragnesia fix. Check this CVE on its own.
- If you cannot reboot soon, Ubuntu's [Dirty Frag mitigation](https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available) applies: block the `esp4` and `esp6` modules. This breaks IPsec VPNs on that host, such as strongSwan.
- For firewalls and other appliances, the fix has to come from the vendor's firmware. Ask the vendor directly. Until then, restrict management access to a VPN or a short allow-list.
- Patch PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 to close the entry point. CISA's due date for both PHP2Shell CVEs is October 29.
- Look before you reboot a suspect host. A changed `/etc/pam.d/su` in memory disappears on reboot. Have your incident responder capture evidence first.
- Hunt on PHP hosts and appliances for small unexpected PHP files in web-readable folders, new systemd services or `rc.local` entries, and outbound SSH sessions you did not set up.
- If a firewall or management server was compromised, rotate any directory service accounts stored in its configuration. Then review Active Directory for new accounts and password spraying.

## Quick hits

**ConnectWise Cloud Backup restores have started.** The [October 28 update](https://www.connectwise.com/company/trust/advisories) says phased restoration has begun with Microsoft 365, through a new app called ConnectWise Cloud Backup for M365. Partners must reset passwords, set up MFA if needed, and re-authorize each tenant with the new app. ConnectWise says not to re-enable previously disabled apps unless it tells you to. After re-authorizing, confirm new snapshots actually complete. No new indicators were published.

**VMware ESX logging flaw is on the exploited list.** CISA also added CVE-2026-41709 on October 28, with a November 11 federal due date. Broadcom rates it low (CVSS 2.7). It lets someone who already has admin access perform some operations without them being logged. It is fixed in builds ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025 and ESXi80U3j-25429389, and in VCF 5.2.4, per [VMSA-2026-0006](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017). It does not let anyone in; it helps someone already inside avoid the logs. Patch at your next maintenance window, along with the vCenter fixes in the same advisory.

## Sources

- [CISA: two known exploited vulnerabilities added, October 28, 2026](https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA Known Exploited Vulnerabilities catalog: CVE-2026-46300](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300)
- [oss-security: Fragnesia disclosure, May 13, 2026](https://www.openwall.com/lists/oss-security/2026/05/13/3)
- [Dream Research: chained PHP2Shell exploit roots 25 servers](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers)
- [Ubuntu: CVE-2026-46300](https://ubuntu.com/security/CVE-2026-46300)
- [Debian security tracker: CVE-2026-46300](https://security-tracker.debian.org/tracker/CVE-2026-46300)
- [Ubuntu: Dirty Frag fixes and mitigation](https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available)
- [ConnectWise security advisories](https://www.connectwise.com/company/trust/advisories)
- [Broadcom VMSA-2026-0006](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017)