AQSh Kiberxavfsizlik va Infratuzilma Xavfsizligi Agentligi (CISA) federal agentliklarga yuqori darajadagi Linux yadro imtiyozlarini oshirish xatosini tuzatishni buyurdi, bu xatolik hujumchilar tomonidan PHP2Shell zaifliklari bilan zanjirlangan holda ishlatilmoqda.
CVE-2026-46300 sifatida kuzatiladigan va Fragnesia deb nomlanuvchi bu zaiflik Linux XFRM ESP-in-TCP tizimidagi mantiqiy xatolikdan kelib chiqadi va hujumchilarga root ruxsatlari bilan zararli kodni ishga tushirish imkonini beradi.
Fragnesia Dirty Frag zaifliklar sinfiga tegishli va 2026-yil 13-maydan oldin chiqarilgan yadro versiyalariga ega asosiy Linux distributivlarida mahalliy hujumchilarga root imtiyozlarini olish uchun ishlatilishi mumkin bo'lgan proof-of-concept (PoC) eksploitiga ega.
CISA chorshanba kuni CVE-2026-46300 ni o'zining Ma'lum Foydalanilgan Zaifliklar (KEV) Katalogiga qo'shdi va federal agentliklarga o'z tizimlarini shanba 10-kuniga qadar tuzatishni buyurdi, bu BOD 26-04 majburiy operatsion direktivasi talabiga muvofiq.
Kiberxavfsizlik agentligi davom etayotgan Fragnesia hujumlari haqida tafsilotlar bermadi, lekin tahdid aktorlari uni ikkita muhim PHP zaifligi (CVE-2026-109618 va CVE-2026-109619) bilan zanjirlashi mumkinligini ta'kidladi, ular birgalikda PHP2Shell deb kuzatiladi, bu esa tuzatilmagan tizimlarda webshell o'rnatish imkonini beradi.
"Bu zaiflik CVE-2026-109618 va CVE-2026-109619 bilan zanjirlanib, PHP webshell o'rnatish va root sifatida buyruqlarni bajarish mumkin," deb aytdi CISA.
Fragnesia va PHP2Shell eksploit zanjiri
CISA Fragnesia va PHP2Shell zaifliklarini zanjirlash haqida ko'proq ma'lumot bermagan bo'lsa-da, Dream Security tahlilchilari dushanba kuni e'lon qilgan hisobotda zaifliklar 25 dan ortiq serverni buzish uchun ishlatilganini aytishdi, jumladan AQSh hukumatiga aloqador tashkilotga tegishli uchta server.
"Dream tadqiqotchilari PHP2Shell eksploit zanjirining (CVE-2026-109618/CVE-2026-109619) maxsus qurollanishi bilan Fragnesia yadro imtiyozlarini oshirish (CVE-2026-46300) birlashtirilgan to'liq hujum operatsiyasini aniqladilar, bu maqsad ro'yxatlari, eksploitatsiya jurnallari va taxminan 40 ta maxsus post-ekspluatatsiya skriptlarini o'z ichiga oladi," deb aytishdi ular.
"Bu AQSh, Yaponiya, Tayvan va Janubiy Koreya bo'ylab 25 ta serverni root qilgan kampaniya artefaktlarini o'z ichiga oldi. Root qilingandan so'ng, hujumchi AQSh hukumatiga aloqador muhitdagi uchta maxsus serverga e'tibor qaratdi."
CISA shuningdek dushanba kuni PHP2Shell zaifliklarini faol foydalanilayotgan zaifliklar ro'yxatiga qo'shdi va Federal Fuqarolik Ijroiya Tarmog'i (FCEB) agentliklariga o'z tarmoqlarini payshanba kuniga qadar himoya qilishni buyurdi.
AQSh kiberxavfsizlik agentligi hali PHP2Shell hujumlari haqida qo'shimcha tafsilotlar bermagan bo'lsa-da, Perplexity xavfsizlik muhandisi Adel Karimi dam olish kunlari honeypotlari Apache mod_php o'rnatishida PHP 8.4.26 ishlatayotgan tizimga qarshi masofaviy kod bajarilishini qayd etganidan so'ng, real dunyoda eksploitatsiya qilinishini tasdiqladi.
CISA vakili BleepingComputer bugun ertaroq murojaat qilganida Fragnesia va PHP2Shell ni hujumlarda zanjirlash mumkin bo'lgan tahdid aktorlari haqida darhol qo'shimcha ma'lumot bera olmadi.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgandan so'ng, ularning harakatlarining faqat 37% bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijoz ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnikadan texnikaga himoyalarni o'lchaydi.
Hisobotni oling
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild.
Tracked as CVE-2026-46300and known as Fragnesia, this vulnerability stems from a logic bug in the Linux XFRM ESP-in-TCP subsystem that lets attackers run malicious code with root permissions.
Fragnesia belongs to the Dirty Frag vulnerability class and has a proof-of-concept (PoC) exploit that local attackers can use to gain root privileges on major Linux distributions with kernels released before May 13, 2026.
CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities (KEV) Catalog on Wednesday and ordered federal agencies to patch their systems by Saturday 10, as mandated by its Binding Operational Directive (BOD) 26-04.
The cybersecurity agency didn't share details about ongoing Fragnesia attacks, but it noted that threat actors could chain it with two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell,to deploy webshells on unpatched systems.
"This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root,"CISA said.
Fragnesia and PHP2Shell exploit chain
While CISA didn't provide more information on attackers chaining the Fragnesia and PHP2Shell flaws, Dream Security analysts said in a Monday report that the vulnerabilities were used to breach more than two dozen servers, including three belonging to a US government-affiliated organization.
"Dream researchers identified a complete attack operation that included a custom weaponization of the PHP2Shell exploit chain (CVE-2026-109618/CVE-2026-109619) paired with the Fragnesia kernel privilege escalation (CVE-2026-46300), target lists, exploitation logs, and approximately 40 custom post-exploitation scripts," they said.
"This included artifacts of a campaign that had rooted 25 servers across the United States, Japan, Taiwan, and South Korea. Once rooted, the attacker zeroed in on three specific servers in a US government-affiliated environment."
CISA alsoadded the PHP2Shell flaws to its list of actively exploited vulnerabilities on Monday and mandated that Federal Civilian Executive Branch (FCEB) agencies secure their networks by Thursday.
While the US cybersecurity agency has not yet provided further details on ongoing PHP2Shell attacks, Perplexity security engineer Adel Karimi confirmed in-the-wild exploitation over the weekend after their honeypotsrecorded evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26.
A CISA spokesperson couldn't immediately share more information about threat actors potentially chaining Fragnesia and PHP2Shell in attacks when BleepingComputer reached out earlier today.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report