Fragnesia is on KEV. A PHP bump is not the kernel.

CISA added CVE-2026-46300 on 28 October. Due 31 October. Forensic triage Yes. Catalog 2026.10.28 / 1762. The row says it chains with PHP2Shell. php -v does not patch uname -r.

RWP Ventures · 2026-10-29 · event 2026-10-28 · 14 min read · priority 9.4

Do not collapse five facts.

1. The overnight increment is KEV, not first disclosure. Fragnesia was public in May 2026 (Red Hat RHSB-2026-003, NVD 23 May). [Yesterday’s Daily Top](/posts/2026-10-28-brotli-cve-2026-111497-kev/) recorded catalog 2026.10.27 / 1760 with this CVE off KEV. [Monday’s PHP2Shell Daily Top](/posts/2026-10-27-php2shell-kev-due-thursday/) recorded catalog 2026.10.26 / 1758 with 109618 / 109619 on KEV and due today. Wednesday night’s listing is the kernel half of that chain and a three-day federal clock.
2. A PHP bump is not the kernel. php-src 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 closes PHP2Shell. CVE-2026-46300 closes when the running kernel is a fixed build — distro package plus reboot, or the appliance vendor’s image. php -v does not change uname -r. Palo Alto’s advisory is explicit: do not replace embedded PHP independently.
3. Forensic triage is Yes. Unlike [Brotli CVE-2026-111497](/posts/2026-10-28-brotli-cve-2026-111497-kev/) (due 10 November, forensic triage No), this row carries the BOD 26-04 pre-patch compromise flag. PHP2Shell already had that flag. A patched package string on either ticket is not the close.
4. The sibling 28 October row is ESX logging, not this kernel. CVE-2026-41709 (Broadcom VMware ESX, CWE-778, CVSS 2.7) was added in the same alert, due 11 November, forensic triage No. It needs admin already. CrowdStrike reported Warp Panda used it as a zero-day to cut ESXi command logging. Do not close a PHP/kernel hunt on an ESXi build, or an ESXi hunt on a kernel RPM.
5. A firewall product notice is not confirmed process impact. Palo Alto (advisory updated 29 October, exploit maturity ATTACKED) says active exploitation has been observed against the management interface when it is exposed to the internet. Dream reported 25 rooted firewalls of an unnamed vendor, including a jump to an internal management server and Active Directory reconnaissance at a U.S. government-affiliated environment. Those are two records. They are not evidence a PLC, safety system, or physical process was hit. Siemens ProductCERT SSA-566512 still lists RUGGEDCOM APE1808 running PAN-OS as affected by PHP2Shell. That remains a product notice.

The operator sentence: if any internet-facing PHP worker on Linux was reachable this week — especially an appliance management plane — treat today as the PHP clock and Friday as the kernel clock. Patch or take it offline, hunt the worker and the host, then reboot into a fixed kernel. A php -v string does not close CVE-2026-46300.

What happened

CISA’s 28 October KEV alert is two rows.

Those are the only two additions in catalog 2026.10.28. Prior newest rows remain [Google Brotli CVE-2026-111497](/posts/2026-10-28-brotli-cve-2026-111497-kev/) and Adobe Commerce / Magento CVE-2026-48356, both added 27 October, due 10 November, forensic triage No. PHP2Shell CVE-2026-109618 / 109619 remain due today, forensic triage Yes.

CISA’s PHP alert was not revised for this kernel add. Last revised 26 October. The 28 October KEV alert is the kernel increment.

Independent reporting fills the gap between “May LPE” and “listed”:

• May 2026. Kernel fix: propagate SKBFL_SHARED_FRAG in skb_try_coalesce(). Red Hat RHSB-2026-003 (Dirty Frag family; Fragnesia is CVE-2026-46300). NVD CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Ubuntu: local privilege escalation, possible container escape; PoCs need the espintcp module (upstream v5.6).
• 21–26 October. PHP2Shell disclosed, patched, then listed on KEV. Due 29 October. [Our 27 October Daily Top](/posts/2026-10-27-php2shell-kev-due-thursday/) recorded that clock. CISA still told operators on unsupported PHP 8.1 or earlier to take those systems offline.
• 23–24 October (Dream, via THN 28 October). Custom PHP2Shell plus Fragnesia against internet-facing firewall management. Dream: FOFA set ~19,000; version responses ~5,000; filtered to U.S. / Japan / Taiwan / South Korea on newer branches running PHP 8.0.30 → 240; batch runner rooted 24; a 25th was an internal firewall management server reached through a reverse SSH tunnel after the second U.S. government-affiliated box. Dream did not name the vendor. Dream assessed a suspected China-nexus operator from targeting geography. CISA did not name an actor on the KEV add.
• 28 October, 19:00 UTC. CISA catalog 2026.10.28 / 1762. Both CVEs on KEV.
• 28–29 October. Palo Alto updated the PHP2Shell product advisory: “Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.” Exploit maturity ATTACKED. Issue strictly the HTTPS web UI and XML API; dataplane only if a management profile is attached. GlobalProtect portal/gateway and Captive Portal not impacted. Most PAN-OS hotfixes are out; 11.1.7-h12 still carried an ETA of 30 October on the 29 October update.

The Hacker News (28–29 October) independently reported the Dream chain and the Palo Alto exploitation line. CISA has not published a victim census, actor name, or ransomware overlay with the add.

Why it matters

Three operational reasons this is the daily.

First, the federal clock is on the second half of a chain that is already due. FCEB agencies have until today for PHP2Shell and until Friday for Fragnesia. BOD 26-04 still wants internet-facing, total-control KEVs treated as priority, and both PHP rows plus this kernel row carry forensic triage: Yes. A ticket that patches PHP and leaves the May kernel in place still hands root to whoever already got the worker.

Second, the false close is php -v. Appliance PHP is a vendor image. General-purpose Linux is a kernel package and a reboot. Ubuntu’s notes: shipping the related Dirty Frag decrypt-time check without the coalescing marker fix leaves the window open. Red Hat: a kernel that is installed but not booted does nothing. Livepatch (Ubuntu LSN-0122-1, 7 October) is a distro path, not an appliance path.

Third, reachability is the management plane, not “we don’t run PHP.” CISA’s 21 October PHP alert, last revised 26 October, already said PHP is often a component of other software and prevalence may not be directly observable. Dream’s recovered implant targeted session.upload_progress on a firewall appweb management server running PHP 8.0.30 — an EOL interpreter CISA told operators to take offline. Palo Alto’s own CVSS for internet-exposed management is 9.2; it drops when management is limited to a jump box.

Who / what is affected

• Linux kernels that still lose SKBFL_SHARED_FRAG on coalesce, in practice those new enough to ship ESP-in-TCP (espintcp, upstream v5.6). Ubuntu: Bionic 4.15 and Focal 5.4 cannot run the public PoCs and are not affected in practice. NVD/kernel.org fixed trains include 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and later stables. Match the running kernel to the distro advisory, not this list copied onto an appliance.
• Red Hat Enterprise Linux 8 / 9 / 10 and anything on the RHEL kernel (OpenShift, RHEL CoreOS, OpenStack). RHSB-2026-003: fixes released; errata begin at RHSA-2026:19521. Mitigation if you cannot patch: block esp4/esp6 (breaks IPsec) or disable unprivileged user namespaces (hits rootless containers, sandboxes, Flatpak).
• Ubuntu current kernels via the USN-8371 / 8373 / 8374 wave and later, plus LSN-0122-1 livepatch (7 October). Confirm uname -r after reboot.
• Any internet-facing PHP worker on an unpatched Linux kernel, especially mod_php and appliance management planes. PHP2Shell floors remain 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. PHP 8.1 and earlier: CISA still says take them offline.
• PAN-OS 10.2 / 11.1 / 11.2 / 12.1 / 12.2 on PA-Series and VM-Series, and Panorama, via the management web interface. Fixed builds are in Palo Alto’s table; 11.1.7-h12 was still ETA 30 October as of the 29 October update. Cloud NGFW, Prisma Access, GlobalProtect App, WildFire appliances: vendor not affected. Cortex XCORE SaaS and WildFire Cloud were remediated 21–22 October.
• Not this KEV row: [Brotli CVE-2026-111497](/posts/2026-10-28-brotli-cve-2026-111497-kev/) (library, due 10 November, forensic triage No). Magento CVE-2026-48356 (same 27 October add). ESX CVE-2026-41709 (same 28 October add, different product, needs admin). PHP informational CVE-2026-115560.

Technical context

High-level, from the kernel commit message, NVD, Red Hat, and Ubuntu. This is not an exploit recipe.

Socket buffers can carry paged fragments that are shared with page cache or other owners. skb_try_coalesce() used to move those fragments onto another skb and drop the shared-fragment marker. ESP input trusted skb_has_shared_frag() before deciding it could decrypt in place. A coalesced skb looked safe and was not. Decrypt then wrote through page-cache-backed data. Red Hat: a local low-privileged attacker can overwrite sensitive system files, including privileged binaries, and get root. Ubuntu: possible container escape. CVSS 7.8 because the attack vector is local. After unauthenticated PHP RCE, local is the worker.

The fix propagates SKBFL_SHARED_FRAG when paged frags are transferred. Ubuntu notes a second related commit on frag-transfer helpers; the two belong together with CVE-2026-43284 (the decrypt-time check).

ATT&CK (defensive mapping, not attribution): T1190 exploit public-facing application (PHP2Shell on the management or web worker), T1068 exploitation for privilege escalation (Fragnesia), T1505.003 webshell. Dream’s reported follow-on — reverse SSH tunnel, LDAP/AD reconnaissance, password spray — maps to T1021.004 and T1110 if that reporting holds. Named public ransomware use: UNKNOWN. CISA’s ransomware field is Unknown.

Threat / exploitation status

What defenders should do

1. Inventory PHP on Linux, then the kernel under it. Internet-facing workers first: Apache mod_php, php-fpm, appliance HTTPS management and XML APIs. Record php -v and uname -r. Appliances: the vendor image, not a host PHP package.
2. Close PHP2Shell today, then Fragnesia before Friday. PHP: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, restart every worker. Unsupported 8.1 and earlier: take offline until a vendor backport exists. Kernel: distro fixed build and reboot, or the PAN-OS / other appliance hotfix. Confirm the running kernel after reboot.
3. Hunt before you reboot. Forensic triage is Yes on 46300 and on both PHP rows. Look for PHP workers spawning shells or unexpected children (CISA’s own PHP-alert telemetry), new PHP files in web-accessible directories, reverse SSH from management planes, new local accounts, and AD spray against the identity tier reachable from the firewall. A reboot without that record destroys the evidence BOD 26-04 is asking for.
4. Restrict management planes now. Palo Alto: limit the management interface to trusted internal IPs / a jump box; that is the documented CVSS drop. Same control is the right default on every NGFW, ADC, and WAF management port this week, patched or not.
5. Do not replace embedded PHP yourself. Palo Alto says so. Siemens SSA-566512 (RUGGEDCOM APE1808 / PAN-OS) is the industrial product ticket — take the vendor image, do not treat it as a PLC compromise.
6. Keep the ESX row on its own ticket. CVE-2026-41709 floors: ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389, Cloud Foundation 5.2.4. Use VMSA-2026-0006.2 section 3e, not the vCenter 9.8 rows in the same advisory. No workaround. Due 11 November, forensic triage No — still hunt if Warp Panda / BRICKSTORM is in your model.
7. Do not close Brotli or Magento on this row. [CVE-2026-111497](/posts/2026-10-28-brotli-cve-2026-111497-kev/) and CVE-2026-48356 are due 10 November. Different assets.
8. Federal / BOD 26-04 clock: PHP2Shell due today. Fragnesia due 31 October. Brotli and Magento due 10 November. ESX logging due 11 November. Collabora 110447 and Arista 114625 were due 26 October. Those clocks did not pause.

RWP is not publishing exploit code, PoC repositories, or a how-to for the coalesce / ESP path.

RWP assessment

High confidence that CISA listed CVE-2026-46300 on 28 October, that catalog 2026.10.28 / 1762 is the current feed, that the row is due 31 October with forensic triage Yes, that CISA’s short description names the PHP2Shell chain, and that PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 plus a booted fixed kernel remain the documented closes for those copies.

High confidence that updating PHP without rebooting a fixed kernel does not remediate 46300, that a host PHP package does not patch appliance PHP, and that this listing is a material increment on yesterday’s Brotli Daily Top and on Monday’s PHP2Shell Daily Top, which recorded 46300 off KEV.

Moderate confidence in the Dream 25-firewall campaign as described (custom exploit, PHP 8.0.30, 23–24 October, three U.S. government-affiliated systems, AD follow-on). That is independent reporting of recovered artifacts, not a CISA victim table. Credential harvest success is UNKNOWN in that reporting.

Low confidence that Dream’s unnamed vendor is Palo Alto, and low confidence in actor identity on the firewall chain. Palo Alto’s ATTACKED line is a separate, vendor-confirmed fact about PHP2Shell against its management interface. Warp Panda is evidenced against CVE-2026-41709, not against 46300. Do not merge the two KEV rows into one actor.

Confidence that this is not OT process impact: high. Palo Alto published a management-plane product notice. Siemens published a PAN-OS-on-APE1808 product notice. No evidence in this retrieval that a controller, safety system, or physical process was affected.

This outranked ESX CVE-2026-41709 (same catalog add, admin-required logging gap, due 11 November, forensic triage No), Palo Alto’s PHP2Shell exploitation confirmation taken alone (material, but it is exploitation of CVEs already on KEV with a clock that expires today — the new federal increment is the kernel row), Magento CVE-2026-48356 and Brotli (yesterday’s Daily Top; no new catalog increment), and CISA ICS notes on EPICS Base / Mitsubishi GENESIS (27 October, no known exploitation).

What we are watching

• A named vendor for Dream’s 25-firewall set, or Palo Alto / CISA tying that set to PAN-OS.
• CISA IOCs, a ransomware overlay, or a revision of the 21 October PHP alert for 46300.
• PAN-OS 11.1.7-h12 actually shipping (ETA 30 October as of 29 October).
• Distro and appliance kernels that still boot a pre-fix uname -r after a PHP ticket closed.
• Whether CVE-2026-41709 grows a forensic-triage flag or a public Warp Panda technical note beyond the Legal Threat Landscape Report.
• PHP2Shell due today. Separate ticket, same chain.

Sources

Primary: CISA 28 October KEV add alert; CISA KEV JSON catalog 2026.10.28 / 1762; CISA PHP alert last revised 26 October; NVD/CVE-2026-46300; kernel.org f84eca58; Red Hat CVE-2026-46300 and RHSB-2026-003; Ubuntu CVE-2026-46300; Palo Alto CVE-2026-109618 advisory updated 29 October; Broadcom VMSA-2026-0006.2 §3e; CrowdStrike 28 October Legal Threat Landscape Report; BOD 26-04 implementation guidance; NVD/CVE-2026-41709. Independent: The Hacker News 28–29 October; SecurityWeek 29 October. Prior RWP: Brotli KEV Daily Top 28 October; PHP2Shell KEV Daily Top 27 October; PHP2Shell Daily Top 22 October.