October 2026 CVE Landscape: PHP2Shell (CVE-2026-109618/109619) + Fragnesia (CVE-2026-46300) chain, Longlegs/Storm-2603 SharePoint exploitation, and other actively exploited CVEs

Key facts for PHP2Shell Fragnesia root chain

Detection coverage for PHP2Shell Fragnesia root chain

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5439 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Fragnesia CVE-2026-46300 Follow-On — su Executed from Service Context / /etc/pam.d/su Tampering (Post-Exploitation)

Detects the privilege-escalation outcome of Fragnesia (CVE-2026-46300): su executed by an account with no login session (auid unset) or a web service uid (www-data, apache, nobody), and writes to /etc/pam.d/su, whose page-cache copy is rewritten to pam_permit.so so that 'su root' works with no password in the PHP2Shell chain (T1068, T1556.003).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1068, T1556.003
• Data sources: linux_audit, auditd, DeviceProcessEvents, DeviceFileEvents
• Severity: critical
• Confidence: high

Splunk SPL

index=linux sourcetype=linux_audit earliest=-24h ```Fragnesia CVE-2026-46300 (T1068, T1556.003): su from service context or pam.d/su tamper```
  ((type=SYSCALL syscall IN (59, 221) exe IN ("/usr/bin/su", "/bin/su") (auid=4294967295 OR auid=unset OR uid IN (33, 48, 65534, 99)))
   OR key="pam_su_tamper")
| eval evidence=if(key="pam_su_tamper", "pam_su_modified", "su_from_service_account")
| stats count min(_time) as first_seen max(_time) as last_seen values(uid) as uid values(auid) as auid values(comm) as comm values(exe) as exe by host, evidence

Microsoft KQL

let WebAccounts = dynamic(["nobody", "www-data", "apache", "wwwrun", "httpd"]);
union
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where FileName =~ "su"
 | where AccountName in~ (WebAccounts) or InitiatingProcessFileName in~ ("httpd", "apache2", "php-cgi") or InitiatingProcessFileName startswith "php-fpm"
 | extend Evidence = "SuFromServiceContext"
 | project Timestamp, DeviceName, Evidence, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName),
(DeviceFileEvents
 | where Timestamp > ago(24h)
 | where FolderPath =~ "/etc/pam.d" and FileName =~ "su"
 | where ActionType in ("FileModified", "FileCreated", "FileRenamed")
 | extend Evidence = "PamSuModified"
 | project Timestamp, DeviceName, Evidence, AccountName = InitiatingProcessAccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine)

Sigma

title: "Fragnesia CVE-2026-46300 Follow-On — su Executed from Service Account"
id: a1c5d7e2-5439-4b01-9a11-0c1f3d7a0002
status: experimental
description: "Detects su executed by a web service account (nobody, www-data, apache), the passwordless root step after Fragnesia (CVE-2026-46300) rewrites /etc/pam.d/su to pam_permit.so in the PHP2Shell chain."
references:
  - https://www.recordedfuture.com/blog/october-2026-cve-landscape
  - https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.privilege-escalation
  - attack.t1068
  - attack.credential-access
  - attack.t1556.003
  - cve.2026-46300
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/su'
    User:
      - 'nobody'
      - 'www-data'
      - 'apache'
      - 'wwwrun'
      - 'httpd'
  condition: selection
falsepositives:
  - "Misconfigured service or cron scripts that run su from a service account for legitimate maintenance"
  - "Administrative automation that rewrites /etc/pam.d/su during hardening"
level: critical

Known false positives:

• Misconfigured service or cron scripts that run su from a service account for legitimate maintenance
• Administrative automation (Ansible/Puppet) that rewrites /etc/pam.d/su during hardening

Tuning notes: Add the auditd rule 'auditctl -w /etc/pam.d/su -p wa -k pam_su_tamper' so the key-based half fires. Fragnesia modifies the page cache, not the on-disk file, so also schedule a FIM or package-verify (rpm -V / debsums) comparison of /etc/pam.d/su against the baseline. Add the uids used by your web stack to the uid list.

• 🔒 SharePoint ToolShell (CVE-2025-53770) — spinstall0.aspx Drop and w3wp Spawning Shells (Exploitation) · unlock with TL Creds
• 🔒 PAN-OS/Linux Persistence — .panops Scripts, [indicator] Injector, rc.local and systemd Unit Writes (Post-Exploitation) · unlock with TL Creds
• 🔒 VS Code Insiders Tunnel Service and iox Tunneling Utility Execution — Longlegs / PHP2Shell Remote Access (C2) · unlock with TL Creds
• 🔒 Apache/PHP Worker Spawning Shell or su — PHP2Shell system() Execution as nobody (Exploitation) · unlock with TL Creds
• 🔒 Syslog Daemon Kill and FortiOS Crashlog Clear — CL-STA-0954 / PEERSTITCH Anti-Forensics (Post-Exploitation) · unlock with TL Creds
• 🔒 Executable or Script Staged in SYSVOL — Warlock Ransomware Propagation Across Domain Controllers (Lateral Movement) · unlock with TL Creds
• 🔒 PHP2Shell CVE-2026-109618/109619 Exploitation Request — PHP_SESSION_UPLOAD_PROGRESS / Oversized PHPSESSID (Exploitation) · unlock with TL Creds
• 🔒 PEERSTITCH / PHP2Shell Campaign Infrastructure Connections — Research and Community-Observed IPs (C2) · unlock with TL Creds

Indicators of compromise for PHP2Shell Fragnesia root chain

As of 2026-11-06, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-5439.

Sample indicators (3 of 23)

• IP address: 15.204.59[.]70
• File hash: b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70
• IP address: 162.35.99[.]94

Defanged, TLP:CLEAR. Full set of 23 indicators: unlock with TL Creds.

How PHP2Shell Fragnesia root chain works

Recorded Future's Insikt Group tracked 82 high-impact vulnerabilities in October 2026, a 13% decrease from September's 94. Of these, 52 carried a Very Critical risk score, 36 were sourced from CISA KEV, 33 from open sources and 13 exclusively from honeypot data; 69 were actively exploited or operationally weaponized, 37 had public PoCs and 37 enabled remote code execution across 51 vendors. The most frequent weakness classes were CWE-78 (8), CWE-287 (7), CWE-22 (6) and CWE-77 (6). Ten of the CVEs are at least five years old, the oldest about sixteen. Recorded Future risk scores are reported rather than CVSS, so no aggregate CVSS applies.

PHP2Shell + Fragnesia. CVE-2026-109618 and CVE-2026-109619 (PHP2Shell, CVSS 9.2 per secondary reporting) are memory-corruption flaws in PHP session/upload handling that give unauthenticated RCE under Apache mod_php; the PHP Foundation fixed them on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Dream Security describes four stages: memory exhaustion via a ~383MB multipart POST, an out-of-bounds read leaking the libphp.so base address, stale-reference setup under ~500MB memory pressure, and a forged HashTable destructor that runs system() as the 'nobody' user. Requests abuse PHP_SESSION_UPLOAD_PROGRESS and oversized PHPSESSID cookies. The attacker then chains CVE-2026-46300 (Fragnesia, CVSS 7.8, a logic bug in the Linux XFRM ESP-in-TCP subsystem in the Dirty Frag class; kernels before the 2026-05-13 fix) to write into the page cache of /etc/pam.d/su, replacing authentication with pam_permit.so so that 'su root' works without a password. The full chain from unauthenticated HTTPS to persistent root takes under 15 minutes. Dream Security observed an apparently Chinese, AI-assisted operation against Palo Alto Networks PAN-OS firewalls: ~19,000 exposed management interfaces were found via FOFA, ~5,000 fingerprinted, 240 filtered to the US, Japan, Taiwan and South Korea, and 24-25 rooted (sources differ on 24 vs 25; at least three servers were US-government affiliated). A custom PHP2Shell build with ~40 post-exploitation scripts, the aiscan platform (DeepSeek/Kimi LLMs), Claude Code and the iox tunneling utility were recovered. Post-exploitation included a 103-byte webshell at /unauth/php/change_password.php, a systemd-wrapped 8-port reverse SSH tunnel with an rc.local hook, extraction of private keys, decryption of an LDAP service-account password, Active Directory enumeration and topology mapping, with 22 firewalls parked for later use. CISA added CVE-2026-46300 to KEV on 2026-10-28 (federal deadline 2026-11-10) and the PHP2Shell CVEs the same week (deadline 2026-10-31). Recorded Future also cites a CYFIRMA assessment of suspected North Korean preparations (21 compromised nodes checking 216 hosts, Lazarus link at moderate confidence), Potassium (Mirai-derived) botnet payload attempts, and probing seen by Arctic Wolf and Cisco Talos. The two attributions conflict and neither is firmly established.

Longlegs / Storm-2603. The group (Symantec: Longlegs; Microsoft: Storm-2603; described as China-nexus) exploited the SharePoint ToolShell chain (CVE-2025-49704, CVE-2025-49706 and bypasses CVE-2025-53770, CVE-2025-53771) against a water utility, a telecom provider, a regional government body and a university in Portuguese- and Spanish-speaking regions. Intrusions deployed web shells, used BloodHound/SharpHound and NetExec, installed Visual Studio Code Insiders as a tunneling service, abused the signed vulnerable K7RKScan driver (CVE-2025-1055) as BYOVD to kill EDR (40+ hosts within two hours in one intrusion), and staged Warlock ransomware in SYSVOL for propagation across domain controllers.

CL-STA-0954 (UNC5820). Unit 42 reports initial access through FortiManager CVE-2024-47575 (FortiJump) beginning September 2024, exposing configurations and trust material for 500+ managed FortiGate firewalls. CVE-2025-61624 (FortiOS auto-script path traversal) gave root, used to drop PEERSTITCH, a memory-resident ARM64 implant that ptrace-patches the miglogd and iked daemons, leaves no on-disk binary or listening port, and tags VPN sessions to skip checks. Anti-forensics included killing syslog daemons, clearing crash logs and auto-deleting rogue accounts.

Other items: Qilin/Settra/Tarnished Scorpius (INC Ransom) activity used PAN-OS CVE-2026-0257 and BloodHound/SharpHound; Integrity Technology Group was linked to espionage and CyberXero to AI-assisted exploitation, with few details in the source. Insikt published Nuclei templates, Sigma, Suricata and Snort rules. The source article lists no IOCs; the IOCs below come from the Dream Security, ampcus and Unit 42 reports.

MITRE ATT&CK techniques by tactic:

Persistence

T1037.004 RC Scripts; T1505.003 Web Shell; T1543.002 Systemd Service

Defense Evasion

T1055.008 Ptrace System Calls

Discovery

T1087.002 Domain Account

Credential Access

T1110.003 Password Spraying; T1552.004 Private Keys; T1556.003 Pluggable Authentication Modules

Initial Access

T1190 Exploit Public-Facing Application

Command and Control

T1219 Remote Access Tools; T1572 Protocol Tunneling

defense-impairment

T1484.001 Group Policy Modification; T1685 Disable or Modify Tools

Remediation for PHP2Shell Fragnesia root chain

Patches

• PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 for CVE-2026-109618 and CVE-2026-109619
• Distribution kernel updates for CVE-2026-46300 (Debian bookworm 6.1.174-1, trixie 6.12.90-1, bullseye 5.10.257-1)
• Vendor fixes for CVE-2024-47575, CVE-2025-61624, SharePoint ToolShell CVEs and CVE-2025-1055
• Palo Alto Networks security releases for affected PAN-OS 12.1/12.2 branches

Immediate actions

• Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and remove /unauth/php/change_password.php
• Patch the Linux kernel to builds after the 2026-05-13 Dirty Frag/Fragnesia fix
• Remove PAN-OS management and GlobalProtect interfaces from direct internet exposure
• Hunt for passwordless 'su root', changes to /etc/pam.d/su, oversized PHPSESSID cookies and multipart POSTs with PHP_SESSION_UPLOAD_PROGRESS
• Rotate Active Directory, LDAP service-account, SSH and TLS keys on any compromised device and rebuild rather than clean
• Rotate cryptographic trust material and credentials for FortiManager-managed FortiGate devices

Workarounds

• Disable esp4, esp6 and rxrpc kernel modules and restrict unprivileged user namespaces until the kernel is patched
• Disable PHP session upload progress where a separate PHP fix is pending (CVE-2026-115560)

Longer-term hardening

• Segment edge management planes from production and AD
• Alert on web or PHP workers spawning shells and on LDAP binds from unexpected hosts
• Block vulnerable drivers such as K7RKScan and monitor SYSVOL for staged payloads
• Monitor for VS Code Insiders installed as a service

Affected and fixed versions

• PHP Group — PHP (Apache mod_php)
  Vulnerable versions: 7.4; 8.0; 8.1; 8.2; 8.3; 8.4
  Fixed in: 8.2.35; 8.3.36; 8.4.27; 8.5.12
• Linux — Linux kernel (XFRM ESP-in-TCP)
  Vulnerable versions: kernels released before 2026-05-13
  Fixed in: Debian bookworm 6.1.174-1; Debian trixie 6.12.90-1; Debian bullseye 5.10.257-1
• Palo Alto Networks — PAN-OS
  Vulnerable versions: 12.1; 12.2 (PHP 8.0.30); 11.1 (tested)
  Fixed in: vendor security releases pending per source
• Microsoft — SharePoint Server
  Vulnerable versions: on-premises builds unpatched for ToolShell
  Fixed in: see Microsoft advisories for CVE-2025-49704/49706/53770/53771
• K7 Security — K7 Anti-Malware (K7RKScan driver)
  Vulnerable versions: drivers affected by CVE-2025-1055
  Fixed in: see vendor advisory
• Fortinet — FortiManager
  Vulnerable versions: builds affected by CVE-2024-47575
  Fixed in: see Fortinet advisory
• Fortinet — FortiOS
  Vulnerable versions: builds affected by CVE-2025-61624
  Fixed in: see Fortinet advisory

Timeline of PHP2Shell Fragnesia root chain

• 2024-09-01 CL-STA-0954 begins an intrusion at a telecom provider by exploiting FortiManager CVE-2024-47575, exposing trust material for 500+ managed FortiGate firewalls (Unit 42; month precision only).
• 2026-05-13 Linux kernel fix for the Dirty Frag/Fragnesia class released; kernels before this date are vulnerable to CVE-2026-46300.
• 2026-07-22 Longlegs/Storm-2603 intrusion via SharePoint ToolShell begins; EDR disabled on 40+ hosts within two hours, locked-ioc-20 ransomware executed on 2026-07-31 (year inferred from the 2026-10-02 report).
• 2026-10-02 Report published on locked-ioc-20 ransomware attacks against a water utility, telecom provider, regional government body and university via SharePoint ToolShell CVEs and CVE-2025-1055.
• 2026-10-08 Dream Security dates the setup of the PHP2Shell/Fragnesia campaign infrastructure to this day.
• 2026-10-14 Unit 42 publishes research on locked-ioc-18, a memory-resident FortiOS implant deployed via CVE-2025-61624.
• 2026-10-21 PHP Foundation fixes CVE-2026-109618/109619 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• 2026-10-23 First PAN-OS firewall rooted at 18:14 UTC in the PHP2Shell + Fragnesia campaign (it crashed).
• 2026-10-24 Second, government-affiliated firewall exploited at 10:09 UTC; management server compromised through the reverse tunnel at 11:35 UTC. Honeypot RCE attempts documented the same day.
• 2026-10-25 Dream researchers discover the campaign and recover target lists, logs and tooling from attacker infrastructure.
• 2026-10-28 CISA adds CVE-2026-46300 to KEV (federal deadline 2026-11-10); PHP2Shell CVEs added the same week.
• 2026-10-31 FCEB remediation deadline for the PHP2Shell vulnerabilities.

Sources cited for PHP2Shell Fragnesia root chain

• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-10-28
• October 2026 CVE Landscape - Recorded Future Insikt Group Recorded Future · Research
• Chained PHP2Shell exploit roots 25 servers - Dream Security dreamgroup.com · Research
• PEERSTITCH and FortiManager CVE-2024-47575 - Unit 42 Unit 42 · Vendor report · 2026-10-14
• Fragnesia PoC repository (v12-security) GitHub · Proof of concept
• Fragnesia (CVE-2026-46300) Chained with PHP2Shell in Active Root-Access Attacks - Ampcus Cyber ampcuscyber.com · Blog · 2026-10-30
• CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks - BleepingComputer BleepingComputer · News · 2026-10-28
• PHP2Shell plus Fragnesia: a dangerous new route from web server to root - CSO Online csoonline.com · News · 2026-10-29
• Attackers exploit FortiOS flaw to plant PEERSTITCH - The Hacker News The Hacker News · News
• Warlock ransomware breaches SharePoint in water, telecom operator attacks - BleepingComputer BleepingComputer · News · 2026-10-02
• Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure - Security Affairs securityaffairs.com · News

More in vulnerability

• Multiple Vulnerabilities in Cisco Products (ISE, ISE-PIC, UCS Central, Unified CM/SME) - CVE-2026-20241, CVE-2026-76419, CVE-2026-76506
• Metasploit 6.5.9 Wrapup: Public Exploit Modules for Citrix NetScaler (CVE-2026-88771), Cisco Secure Email Gateway (CVE-2026-76461/76443), GitLab CI/CD Regex RCE (CVE-2026-97229), OpenBullet2, Flowise, SPIP and WordPress Bug Library
• CVE-2026-113618: Improper Certificate Validation in KAMSOFT ZSIRep CLIENT library
• D-Link DGS-3130 Series Switches: Multiple Unpatched Zero-Days in D-Link Discovery Protocol (DDP) and Firmware (D-Link SAP10523, CVEs Pending)
• Multiple Vulnerabilities in Microsoft Edge (prior to 157.0.4341.42) - 27 Chromium CVEs - HK GovCERT A26-11-10

Further reading

• npm Supply Chain Attacks 2026: 218 Packages
• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors