Hackers Chain PHP2Shell and Linux Kernel Exploits to Gain Root Access on 25 Servers

Hackers have combined PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with the Fragnesia Linux kernel privilege escalation flaw (CVE-2026-46300) to gain root access on 25 servers across the United States, Japan, Taiwan, and South Korea, including three systems in a US government-affiliated environment. The attack involved a custom, nonpublic PHP2Shell implementation targeting a firewall's appweb management server, leading to memory exhaustion and address leakage, followed by Fragnesia to achieve root access.