CISA's Three-Day Patch Window for Flagnesia: A Kernel Flaw That Turns an HTTP Request Into Root
CISA listed CVE-2026-46300 on its Known Exploited Vulnerabilities catalog on October 28 with a federal deadline of October 31. The flaw, part of the Dirty Frag class, chains with PHP2Shell to give an unauthenticated remote attacker full root on any exposed Linux server. Dream Security traced a campaign that already did exactly that on 25 machines across four countries.
On Wednesday, October 28, CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog, giving federal agencies until Saturday, October 31, to patch under BOD 26-04. The vulnerability, dubbed Flagnesia, is a local privilege escalation in the Linux kernel’s XFRM ESP-in-TCP subsystem — part of the broader Dirty Frag class of kernel bugs — and carries a CVSS score of 7.8. The number itself is unremarkable for a local escalation. What makes the listing urgent is the chain CISA explicitly warns about: pair Flagnesia with CVE-2026-109618 and CVE-2026-109619, the two components of PHP2Shell, and an unauthenticated remote attacker can implant a PHP webshell and execute arbitrary commands as root on any internet-facing server running an unpatched kernel and a vulnerable PHP stack.
The chain is the whole story. A local privilege escalation on a box you already have a shell on is a maintenance headache; a local privilege escalation that an HTTP request over the public internet can trigger before you ever see the request is an incident. CISA’s advisory is specific that the two PHP2Shell CVEs supply the remote code execution half of the attack, and Flagnesia supplies the privilege escalation that turns a low-privilege PHP process into a root shell in a single step. The result is not a slow compromise you can monitor and contain; it is a one-shot root on a machine that was never supposed to be exposed in that way.
Dream Security documented a campaign that did exactly this, rooting 25 internet-facing Linux servers spread across the United States, Japan, Taiwan, and South Korea, including three in what the firm described as a US government-affiliated environment. The campaign is not a single actor’s one-off experiment; it is a repeatable technique that anyone with the two PHP2Shell exploits and the Flagnesia exploit can run against any exposed server matching the affected configuration, which in practice means a substantial slice of the long tail of Linux hosts that sit behind nginx or Apache with PHP handling the application layer.
The exposure surface extends well beyond generic web servers. Palo Alto Networks updated its PHP2Shell advisory to confirm active exploitation against internet-exposed PAN-OS management interfaces, and security researcher Kevin Beaumont reported a ransomware group using the same PHP2Shell primitives to gain initial access on Palo Alto firewalls — a category of box that, by design, sits at the network perimeter and whose compromise hands an attacker visibility into everything that crosses it. A firewall backdoored this way is not just another compromised host; it is a vantage point from which the rest of the chain becomes invisible to the victim’s own monitoring.
The in-the-wild status is no longer theoretical. Perplexity confirmed remote code execution in its own honeypot over the weekend immediately preceding the KEV listing, meaning the exploit chain was already executing against infrastructure that was deliberately left exposed, in the days before CISA even added the CVE to the catalog. That timeline — active exploitation confirmed by a private-sector sensor, then a federal listing three days later with a patch deadline of four days after that — is as tight as the window between a vulnerability becoming exploitable and it becoming a mandatory federal action gets.
The same day CISA lifted Flagnesia into the KEV catalog, it also listed CVE-2026-41709, a VMware ESX logging zero-day that CrowdStrike attributed to the China-nexus group WARP PANDA, which used it to hide its tracks after initial compromise. That one carries a November 11 deadline, giving administrators roughly two weeks of breathing room that the Flagnesia patch does not. But the pairing of the two additions on the same day — a kernel privilege escalation being chained into a remote root exploit, and a hypervisor logging flaw being used for anti-forensics — points to a threat landscape where the initial access and the cleanup are being executed by the same operation, often within the same kill chain.
The practical takeaway for anyone with a Linux server that has a public IP and a PHP interpreter in the request path is the same three days CISA gave its own agencies: patch the kernel and the PHP stack before Saturday, or accept that the chain is already public and the window is closing. The 25 servers Dream Security identified are the confirmed casualties; the unlisted ones are the ones nobody will ever hear about.