Threat reportVulnerabilityTL-2026-4686
PHP2Shell (CVE-2026-109618/CVE-2026-109619) + Fragnesia (CVE-2026-46300) Chain Roots 25 Servers, Breaches U.S. Government-Affiliated Network
PHP2Shell (CVE-2026-109618/CVE-2026-109619) + Fragnesia (TL-2026-4686), also tracked as PHP2Shell, is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-10-29. It is linked to a China-nexus actor with low confidence, affects PHP Group PHP (session.upload_progress; mod_php, PHP-FPM, php-cgi, references 4 CVEs (CVE-2026-109618, CVE-2026-109619, CVE-2026-46300), maps to 17 MITRE ATT&CK techniques (T1037.004, T1059.004, T1069.002), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 9.2/10Critical
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4686
- Threat ID
- TL-2026-4686
- Also known as
- PHP2Shell, Fragnesia
- Severity
- CRITICAL
- CVSS
- 9.2
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, network-security-appliances
- Target regions
- North America, East Asia, japan, taiwan, south korea
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in PHP2Shell (CVE-2026-109618/CVE-2026-109619) + Fragnesia
Malware and tooling: PHP, iox, Claude Code, FOFA, aiscan, iox
How PHP2Shell (CVE-2026-109618/CVE-2026-109619) + Fragnesia works
A suspected China-nexus operator chained the PHP2Shell unauthenticated RCE flaws with the Fragnesia Linux kernel LPE against internet-exposed firewall management interfaces, rooting 25 servers in the U.S., Japan, Taiwan and South Korea. The actor reached the internal network of a U.S. government-affiliated organization via root PHP web shells and an 8-port reverse SSH tunnel, then began Active Directory reconnaissance and password spraying.
Dream researchers recovered artifacts from attacker infrastructure showing a custom, non-public weaponization of PHP2Shell (CVE-2026-109618 and CVE-2026-109619) paired with Fragnesia (CVE-2026-46300) against the appweb management server of an undisclosed large firewall vendor. Targets ran PHP 8.0.30 (7.4.33 also appears in the artifacts) with SELinux httpd_t confinement. Dream does not attribute the activity to a named actor, but cites multiple China-nexus indicators: targeting limited to the U.S., Japan, Taiwan and South Korea, infrastructure on UTC+8, use of the FOFA search engine, the Chinese-developed iox tunneling tool, DeepSeek and Kimi LLM configurations, and Chinese-language prompts in aiscan logs.
PHP2Shell is a pair of memory-safety flaws disclosed and patched by the PHP project on 2026-10-21 (fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with backports for 7.4, 8.0 and 8.1). CVE-2026-109619 is a use-after-free (CWE-416) in the session.upload_progress feature, where cached zval pointers dangle after session hash tables are replaced. CVE-2026-109618 is memory corruption after an out-of-memory condition forces a longjmp that skips cleanup (CWE-400). Both are rated CVSS v4.0 9.2. Per Dream, the exploit ran in stages: memory exhaustion of about 383MB via a multipart POST with crafted filenames, an out-of-bounds read leaking the libphp.so base address through a Set-Cookie header, a stale-reference setup of about 500MB, and a forged HashTable whose pDestructor points to zif_system. This yielded command execution as the nobody user.
Privilege escalation used Fragnesia (CVE-2026-46300, CVSS 7.8), a Linux kernel XFRM ESP-in-TCP flaw disclosed on 2026-05-13 by William Bowling (V12 Security). skb_try_coalesce() fails to propagate SKBFL_SHARED_FRAG, allowing writes into the page cache of readable files. The actor used a per-byte page-cache write to replace /etc/pam.d/su (774 bytes) with a pam_permit.so configuration, then ran su root without a password. A 103-byte root PHP web shell was planted and verified with the id command. Persistence was a systemd service plus an rc.local boot hook, and an 8-port reverse SSH tunnel with a SOCKS5 proxy (iox is listed among the tools) gave access to the internal network.
The campaign funnel was about 19,000 firewalls found through FOFA, about 5,000 alive per a custom scanner (200 threads), 240 filtered targets (target countries, PHP 8.0.30), and 24 firewalls exploited. Of these, 22 were parked with web shells and 2 government targets were prioritized. One internal firewall management server was also rooted, giving 25 compromised servers in total. Eleven JSON version profiles held SHA256 hashes, ELF build IDs and exact memory offsets for each tested firewall OS version. About 40 custom post-exploitation scripts showed AI-assisted development, and Claude Code and aiscan (with DeepSeek and Kimi) were found on the infrastructure.
Post-compromise, from the management server the actor decrypted the LDAP service account password from the encrypted device config, enumerated users and groups, and sprayed passwords against all users (the domain had lockoutThreshold=0). The actor also attempted backdoor user creation in every OU and machine account creation via the default MachineAccountQuota, analyzed AD ACL chains, and probed Keycloak for SAML signing key extraction and authentication bypass. Outcomes of the spray, backdoor and key-extraction attempts were not recovered. Harvested material included HA replication keys, TLS certificate keys and device authentication keys. CISA added CVE-2026-109618 and CVE-2026-109619 to the KEV catalog on 2026-10-28 with a federal due date of 2026-10-29. No network IOCs (IPs, domains, hashes) were published in the sources reviewed, so none are listed.
MITRE ATT&CK techniques used in TL-2026-4686
Persistence
T1037.004 RC Scripts; T1136.002 Domain Account; T1505.003 Web Shell; T1543.002 Systemd Service
Execution
Discovery
T1069.002 Domain Groups; T1087.002 Domain Account
Command and Control
T1090 Proxy; T1572 Protocol Tunneling
Credential Access
T1110.003 Password Spraying; T1552 Unsecured Credentials; T1556.003 Pluggable Authentication Modules
Initial Access
T1190 Exploit Public-Facing Application
Resource Development
T1587.004 Exploits; T1588.007 Artificial Intelligence
Reconnaissance
Affected products and versions in PHP2Shell (CVE-2026-109618/CVE-2026-109619) + Fragnesia
- PHP Group — PHP (session.upload_progress; mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed)
Vulnerable versions: All PHP installations serving web requests before the October 21, 2026 releases; 8.0.30; 7.4.33
Fixed in: 8.5.12; 8.4.27; 8.3.36; 8.2.35; Backports for 7.4, 8.0, 8.1 - Linux — Linux kernel XFRM ESP-in-TCP (Fragnesia)
Vulnerable versions: Kernels without the May 13, 2026 netdev fix (Ubuntu, RHEL, openSUSE, CentOS Stream, Debian, Gentoo reported affected)
Fixed in: Kernels with the May 13, 2026 fix, e.g. AlmaLinux 5.14.0-611.54.4.el9_7 - Undisclosed large firewall vendor — Firewall appliance appweb management server (PHP 8.0.30)
Vulnerable versions: Versions bundling vulnerable PHP; vendor not named by researchers
Remediation for PHP2Shell (CVE-2026-109618/CVE-2026-109619) + Fragnesia
Patches
- Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply vendor backports for 7.4, 8.0 and 8.1
- Apply Linux kernel updates containing the May 13, 2026 Fragnesia fix (CVE-2026-46300)
- Apply the firewall vendor's fixed release once available
Immediate actions
- Remove internet exposure of firewall and appliance management interfaces; restrict them to dedicated management networks
- Hunt for 103-byte PHP web shells in web-accessible directories of firewall management servers
- Hunt for unexpected reverse SSH tunnels, SOCKS5 proxies and iox-style tunnel processes originating from firewall and management hosts
- Check /etc/pam.d/su for replacement with pam_permit.so and for unexpected systemd units or rc.local entries
- Rotate LDAP service account, HA replication, TLS and device authentication credentials stored on potentially compromised appliances
Workarounds
- Set session.upload_progress.enabled=0 (partial; does not cover all variants)
- Set memory_limit=-1 and reduce post_max_size for CVE-2026-109618 (partial)
- Blacklist esp4, esp6 and rxrpc modules for Fragnesia: rmmod esp4 esp6 rxrpc and install them as /bin/false in modprobe.d
Longer-term hardening
- Set a non-zero AD lockoutThreshold and reduce ms-DS-MachineAccountQuota
- Audit AD ACLs and review for unexpected user or machine accounts in every OU
- Validate SAML IdP certificate checking and review Keycloak for signing key access
- Monitor for anomalous outbound SSH from perimeter devices
CVEs associated with PHP2Shell (CVE-2026-109618/CVE-2026-109619) + Fragnesia
CVE-2026-109618, CVE-2026-109619, CVE-2026-46300, CVE-2026-115560
Weaknesses (CWE) in PHP2Shell (CVE-2026-109618/CVE-2026-109619) + Fragnesia
Timeline of PHP2Shell (CVE-2026-109618/CVE-2026-109619) + Fragnesia
- Fragnesia (CVE-2026-46300) Linux kernel XFRM ESP-in-TCP LPE disclosed by William Bowling (V12 Security); fix posted to netdev and public PoC released.
- Per Dream's analysis of recovered artifacts, the attacker's campaign infrastructure setup began.
- PHP2Shell (CVE-2026-109618 and CVE-2026-109619) announced; discoverers credited as Calif, OpenAI and Wiz.
- PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (plus backports for 7.4, 8.0, 8.1); Cloudflare reported early attacks and deployed WAF protections.
- First U.S. government-affiliated firewall rooted at 18:14 UTC; it crashed after exploitation and was probed 240 times over the next two hours.
- Second government firewall exploited at 10:09 UTC; at 11:35 UTC the attacker rooted the internal firewall management server through the tunnel and began Active Directory activity. Honeypots also saw 35 shell commands from two IPs against PHP 8.4.26 under mod_php.
- Dream published its findings: 25 servers rooted (24 perimeter firewalls plus one internal management server) in the U.S., Japan, Taiwan and South Korea, with 22 firewalls still holding active web shells.
- CISA added CVE-2026-109618 and CVE-2026-109619 to the KEV catalog with a federal remediation deadline of 2026-10-29.
Sources cited for PHP2Shell (CVE-2026-109618/CVE-2026-109619) + Fragnesia
- PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
- Chained PHP2Shell Exploit Roots 25 Servers (Dream)
- PHP2Shell flaws exploited: CISA gives US agencies until Thursday
- Understanding PHP2Shell: Everything You Need to Know (Akamai)
- PHP ships emergency patches for critical PHP2Shell flaws (BleepingComputer)
- The Register: PHP2Shell and third PHP CVE-2026-115560
- Fragnesia (CVE-2026-46300): FAQ about new Linux Kernel XFRM ESP-in-TCP priv esc (Tenable)
- Understanding PHP2Shell vulnerabilities and reducing risk while you patch (Fortinet)
- Dream Reports PHP2Shell Attack Chain That Compromised 25 Servers (Unite.AI)
- CISA Says PHP2Shell Flaw Under Attack as Reports of More Come In (Security Boulevard)
Detection coverage for TL-2026-4686
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4686 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.