A US cyber agency says attackers are pairing a Linux flaw with two PHP flaws to take full control of web servers. Unpatched sites are at risk.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) says attackers are combining three security flaws to take over Linux web servers. One flaw lives in Linux itself and is called Fragnesia. The other two affect PHP, a common language websites run on, and are known together as PHP2Shell. CISA has ordered federal agencies to fix them.
Fragnesia is tracked as CVE-2026-46300. It is a logic bug in part of the Linux kernel, the core of the operating system. It lets an attacker run code with root permissions, which means total control of the machine. A working proof-of-concept exploit exists for major Linux versions with kernels released before May 13, 2026.
CISA added Fragnesia to its list of known exploited vulnerabilities on Wednesday and gave federal agencies until Saturday to patch. It added the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) on Monday, with a Thursday deadline.
The PHP flaws can let an attacker run commands on a website server. Fragnesia then raises that limited foothold to full root control. CISA says the combination can be used to plant PHP webshells, which are hidden files that give an attacker a back door, and to run commands as root.
This is already happening. Security firm Dream Security reported a campaign that rooted 25 servers across the United States, Japan, Taiwan and South Korea. Three of them were in a US government-affiliated environment. Dream also found target lists, logs and about 40 custom scripts. Separately, Perplexity security engineer Adel Karimi said his honeypots, which are decoy servers, recorded attacks on an Apache mod_php setup running PHP 8.4.26.
The reports center on Linux servers that run PHP, including Apache with mod_php. If you own a website, the question is whether your server or hosting provider has applied recent updates. If you only use websites or apps, nothing in the reports points to a step you need to take. They describe attacks on servers, not on personal phones or laptops.
The alert box above lists the steps. The short version is to ask whoever runs your server whether both Linux and PHP are fully updated, and to have someone check your site files for anything you did not put there.
Several things are still unclear. CISA has not shared details of the attacks that chain these flaws. A CISA spokesperson could not give more information when BleepingComputer asked. The reports also do not say how many other servers may have been hit. Expect more details from CISA and security researchers in the coming days.
If your website runs on Linux with PHP, confirm this week that both have been updated, and have someone check for files you did not create.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
