CISA Adds Fragnesia to KEV After PHP2Shell Chain Roots PAN-OS Firewalls: What to Patch

Security firm Dream Research reported that attackers chained two PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, with the Linux kernel privilege escalation bug to gain root on 25 devices, as summarized by eSecurity Planet on October 29, 2026. Palo Alto Networks Unit 42 independently verified the attacker tooling in its October 29 threat brief.

What Happened

Attackers targeted PAN-OS management interfaces exposed to the internet, used the PHP flaws for initial code execution, then used Fragnesia to escalate to root. Both CVSS 4.0 ratings for the PHP bugs are 9.2, and Fragnesia is rated 7.8 under CVSS 3.1.

CISA listed Fragnesia on October 28, 2026 with a federal civilian remediation deadline of October 31, according to eSecurity Planet. Canonical's advisory shows the bug was disclosed publicly on May 13, 2026 and sits in the kernel modules that handle ESP, a part of IPsec. Fixes exist for supported Ubuntu releases and need a reboot.

Dream Research counted 25 compromised devices across the US, Japan, Taiwan and South Korea, 24 of them exposed firewalls and one an internal management server. Unit 42 notes that management interfaces are not exposed by default, so the affected systems were reachable because administrators opened them to the internet.

Why It Matters

Fragnesia needs local code execution first, so alone it is a second-stage bug. Chained with a remote flaw it turns a web-facing foothold into full control, and on a firewall that means attackers can reach credentials, tunnels and internal networks.

Firewalls and VPN gateways sit at the trust boundary. A root-level compromise there can expose traffic, certificates and directory credentials. Reporting on one affected government-affiliated environment described a persistent tunnel, credential extraction and Active Directory enumeration, which is the pattern security teams should hunt for.

What It Means for B2B SaaS Buyers and IT Teams

Vendors that run Linux hosts or PAN-OS appliances may be exposed, and customers should ask suppliers how fast they patch actively exploited flaws. Treat KEV-listed bugs as emergency changes in your own estate and in vendor risk reviews.

• Inventory: list Linux hosts, container nodes and firewall management planes, and who patches them.
• Vendor risk: request evidence of patch timelines and management-plane exposure from critical suppliers.
• Detection: make sure SIEM and EDR cover appliances, which often lack agents.

These controls map to products in vulnerability management software, network security software and SIEM platforms. See our related guide on vulnerability management tools and the earlier report on the PHP remote code execution patch.

What to Do Now

Patch the kernel and the firewall, shrink the management attack surface, then hunt for signs of earlier compromise. Do the exposure fix first if patching must wait, because removing public access breaks the first link in the chain.

• Remove internet access to PAN-OS management interfaces and restrict them to trusted internal addresses.
• Apply the PAN-OS fixes described in the Palo Alto Networks advisory and the PHP Group's patches.
• Install distribution kernel updates for CVE-2026-46300 and reboot. Where an Ubuntu kernel cannot be patched immediately, Canonical documents blocking the esp4 and esp6 modules, which breaks IPsec until removed.
• Hunt for unexpected root activity, web shells, persistent tunnels and unusual Active Directory queries.
• Rehearse containment: preserve evidence, rotate credentials and rebuild compromised management systems.

Frequently Asked Questions

Does Fragnesia affect every Linux system?
Reporting indicates it affects many distributions that include the ESP kernel modules, but impact depends on kernel version and configuration. Check your distribution's advisory, such as Canonical's for Ubuntu, and patch with a reboot.

Are PAN-OS firewalls vulnerable by default?
Unit 42 states management interfaces are not exposed by default. The observed attacks targeted interfaces administrators had exposed to the internet, so restricting management access to trusted networks removes that path.

Can I delay patching if I block ESP modules?
Only as a short-term step. Canonical documents disabling esp4 and esp6 as a workaround, but it breaks IPsec VPNs, so install the kernel update, reboot and then remove the workaround.