# Source: Fragnesia and PHP2Shell: Web Shell to Root in Two Steps

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

orcarouter.ai: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Fragnesia and PHP2Shell: Web Shell to Root in Two Steps

**orcarouter.ai** · [https://www.orcarouter.ai/blog/cve-2026-46300-fragnesia-php2shell-chain](https://www.orcarouter.ai/blog/cve-2026-46300-fragnesia-php2shell-chain) · published not stated in the capture · added by `curator@php.newsroom` · slug `orcarouter-blog-cve-2026-46300-fragnesia-php2shell`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261030T145837Z, queue priority 2 (mechanical selection by researcher@php.newsroom, read by the curator). A blog analysis (OrcaRouter, an AI-incident archive) of the second stage of the campaign Dream Security reported: the Linux kernel local privilege esc...

## What it says, as the collector read it

#### Fragnesia and PHP2Shell: Web Shell to Root in Two Steps

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `au/news/orcarouter/blog-cve-2026-46300-fragnesia-php2shell-chain`, snapshot `20261030T145837Z`. Copied byte for byte; every file's sha256 is in `captures/20261030T145837Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

A blog analysis (OrcaRouter, an AI-incident archive) of the second stage of the campaign Dream Security reported: the Linux kernel local privilege escalation CVE-2026-46300, 'Fragnesia', disclosed in May 2026 with a public proof of concept and added to CISA's Known Exploited Vulnerabilities catalog on 28 October, used after PHP2Shell gave a foothold on internet-exposed Palo Alto management interfaces. Per Dream's report as summarised in press, 25 servers were rooted across the United States, Japan, Taiwan and South Korea, including one network linked to the US government. The author argues the chain shows why patching PHP without the kernel leaves a window open and notes press reports that AI tooling may have contributed to the intrusion, which it says is not established.

> That claim is not established, and the honest reading is that it is a hypothesis attached to a fast, multi-target operation rather than a finding anyone has published evidence for.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): Mentions CVE-2026-109618/109619 or php2shell: "Fragnesia and PHP2Shell: Web Shell to Root in Two Steps". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

#### Capture notes

Language `en`. Commentary on other parties' reports (CISA, Tenable, Dream Security), not a primary source; the capture shows no publication date, and the page carries a product banner and the author's own traffic figures, which are not recorded. The page describes the kernel flaw's mechanism and interim mitigations; none is copied. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261030T145837Z · HTTP 200 · https://www.orcarouter.ai/blog/cve-2026-46300-fragnesia-php2shell-chain- `headers.json` cdde41190a4a29c15cc06a7bac7f1a9649591aab289370424324c49e60145f7b 598 bytes
- `page.html` 411f7c5de96e4414318258908001b4a9b719708db423d29289a4e83922b245d7 38,241 bytes
- `provenance.json` a0af82089e5385977b46d1f341413c0c826e195d62746bba765a986d42f79859 1,686 bytes
- `rendered.html` 8ccc1e3e92d789d1ca273578c69e17cf58fa12abb934169ecd400043f0a62109 203,133 bytes
- `screenshot.jpg` ac5952d057a311ad775b462703bd01167c37fd4151917dbb0b3aff275a435d76 579,220 bytes
- `text.txt` cedd0b4a01168ecb92d9ca0901704a69e62491399f1b353c93340701540c4567 10,100 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.55 · data as of 2026-10-30T17:13Z · vault commit 2f80607e87ad · https://refs.php.oct.2026.newsroom.sgit.ai/sources/orcarouter-blog-cve-2026-46300-fragnesia-php2shell/index.html