Fragnesia and PHP2Shell: Web Shell to Root in Two Steps

Fragnesia and PHP2Shell: Web Shell to Root in Two Steps

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page au/news/orcarouter/blog-cve-2026-46300-fragnesia-php2shell-chain, snapshot 20261030T145837Z. Copied byte for byte; every file's sha256 is in captures/20261030T145837Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

A blog analysis (OrcaRouter, an AI-incident archive) of the second stage of the campaign Dream Security reported: the Linux kernel local privilege escalation CVE-2026-46300, 'Fragnesia', disclosed in May 2026 with a public proof of concept and added to CISA's Known Exploited Vulnerabilities catalog on 28 October, used after PHP2Shell gave a foothold on internet-exposed Palo Alto management interfaces. Per Dream's report as summarised in press, 25 servers were rooted across the United States, Japan, Taiwan and South Korea, including one network linked to the US government. The author argues the chain shows why patching PHP without the kernel leaves a window open and notes press reports that AI tooling may have contributed to the intrusion, which it says is not established.

> That claim is not established, and the honest reading is that it is a hypothesis attached to a fast, multi-target operation rather than a finding anyone has published evidence for.

Why it is here

From the promotion queue (index/promote.json, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "Fragnesia and PHP2Shell: Web Shell to Root in Two Steps". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

Capture notes

Language en. Commentary on other parties' reports (CISA, Tenable, Dream Security), not a primary source; the capture shows no publication date, and the page carries a product banner and the author's own traffic figures, which are not recorded. The page describes the kernel flaw's mechanism and interim mitigations; none is copied. Nothing in the page addresses an AI or hides text from a reader.