Fragnesia is on KEV, and it is the root half of the PHP2Shell chain

you already patched PHP for PHP2Shell. good. CISA just put the Linux kernel bug that turns “nobody webshell” into “root on the firewall” on KEV. CVE-2026-46300, aka Fragnesia, due date October 31, which is today. the sloth is not kidding about the calendar.

what the KEV entry actually says

• CVE-2026-46300, “Linux Kernel Missing Initialization of a Variable Vulnerability.” page-cache-backed data can be modified when ESP input decrypts shared fragments in place after socket buffer coalescing loses the shared-fragment marker.
• due October 31. that is the shortest BOD 26-04 window in this catch-up batch. forensic triage required.
• fixes: kernel stable commits including f84eca5817 (“net: skbuff: preserve shared-frag marker during coalescing”) and related frag-transfer propagation fixes. pull your distro’s kernel that includes those, or build from a tree that does.

Zellic researcher William Bowling authored the coalescing fix. the bug class is Dirty Frag: shared page-cache pages end up writable because a flag got dropped on the floor.

how Fragnesia works, in sloth speed

1. shared frags exist for a reason. TCP receive paths can point skb fragments at page-cache pages. the kernel marks those with SKBFL_SHARED_FRAG so later in-place writers know to copy-on-write.
2. coalesce drops the marker. skb_try_coalesce() can attach paged frags from one skb to another and forget to propagate the shared-frag flag. related helpers (skb_shift, __pskb_copy_fclone, GRO receive paths) had the same family of bugs.
3. ESP decrypts in place. XFRM ESP input checks skb_has_shared_frag() before deciding whether to skip skb_cow_data(). if the marker is gone, ESP decrypts over page-cache-backed frags.
4. write the page cache. a local attacker who can feed ESP-in-TCP (or hit the other frag-transfer paths) can write arbitrary bytes into root-owned read-only files. public write-ups describe overwriting /etc/pam.d/su with pam_permit.so rules so su root needs no password.
5. chain with PHP2Shell. Dream researchers documented a China-linked operator pairing a custom PHP2Shell exploit (nobody on the appweb management plane) with Fragnesia to root 25 firewalls across the US, Japan, Taiwan, and South Korea, then tunneling toward Active Directory from a US government-affiliated environment.

PHP2Shell alone is a webshell as the web user. Fragnesia is why that webshell becomes the host.

what to do before the end of today

1. patch the kernel to a build that includes the shared-frag coalescing and frag-transfer fixes. reboot. containers share the host kernel, so the node is the unit of work, not the pod.
2. if the host was internet-facing PHP (especially appliance / firewall management planes with PHP), assume the PHP2Shell + Fragnesia chain until proven otherwise. that means forensic triage, not just apt upgrade.
3. hunt PAM and page-cache tells. unexpected changes to /etc/pam.d/*, new setuid helpers, webshells under the app root, and outbound tunnels from management interfaces.
4. finish the PHP side if you have not: PHP builds that close CVE-2026-109618 / 109619, and remove any 103-byte or similar webshells left behind.
5. edge appliances that vendor their own kernel need the vendor’s advisory, not a generic Ubuntu package. Dream’s victims were firewalls. ask your firewall vendor which image includes the fix.

sloth take

two PHP CVEs made the headlines. the kernel CVE made the root shell. CISA put all three on KEV and gave Fragnesia until today. if your patch story stops at “we bumped PHP,” you fixed the foothold and left the elevator to root running. the sloth suggests a kernel reboot before bedtime.

if your edge stack or storefront still has a KEV item open, get a second set of eyes before the federal deadline. Book a slot with Dark Edge Consulting.

sources

• CISA KEV entry for CVE-2026-46300 (added October 28, 2026)
• Linux kernel commits f84eca5817 and related shared-frag propagation fixes
• Tenable / BleepingComputer coverage of Fragnesia and the PHP2Shell chain
• Dream research on PHP2Shell + Fragnesia firewall rooting (October 26, 2026)
• Cybersecsloth PHP2Shell ITW and KEV articles