{"resourceId":"cisa-kev-cve-2026-46300-fragnesia-chained-with-php2shell-forensic-triage-20261028","versions":[{"version":"external-fbdd9de6f2275565bd605cc69092090758e9bb92c99596f3b5b278a764bc01af","resource":{"id":"cisa-kev-cve-2026-46300-fragnesia-chained-with-php2shell-forensic-triage-20261028","title":"CISA KEV adds Linux kernel Fragnesia (CVE-2026-46300), noting it can be chained with PHP2Shell to implant webshells as root, with forensic triage required and an Oct. 31 federal due date","organization":"Cybersecurity and Infrastructure Security Agency (CISA)","sector":"Federal cybersecurity agency / vulnerability catalog","geography":"United States","publishedAt":"CISA Known Exploited Vulnerabilities Catalog entry added Oct. 28, 2026","publicationDate":"2026-10-28","eventDate":"2026-10-28","sourceName":"CISA Known Exploited Vulnerabilities Catalog","sourceLabel":"CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-46300","evidenceClass":"standards-guidance","outcomeClass":"cautionary","topics":["infrastructure","governance-procurement"],"finding":"CISA added CVE-2026-46300 (Fragnesia) to the KEV catalog on Oct. 28, 2026 based on evidence of active exploitation, stating it can be chained with CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) to implant PHP webshells and run commands as root. The entry marks forensic triage as required under BOD 26-04 and sets a federal remediation due date of Oct. 31, 2026. The PHP2Shell entries were added on Oct. 26 with an Oct. 29 due date and also require forensic triage. The entry does not name Palo Alto Networks; the PAN-OS link comes from the Dream and Unit 42 reports archived in the Oct. 29 edition.","sledRelevance":"BOD 26-04 binds only federal civilian agencies, but CISA encourages all organizations to follow KEV. The forensic-triage flag is a federal signal that state, local and education teams should check for compromise before closing PAN-OS patch tickets.","evidence":"Opened and read the KEV catalog page entry for CVE-2026-46300, and checked dateAdded, dueDate, forensicTriage and description against the CISA KEV JSON feed (catalog version 2026.10.30). Also read the Oct. 28 CISA alert page, which lists the addition without the chaining note.","architectureImplications":"The chain needs both a PHP fix on the appliance and attention to the underlying Linux kernel; on PAN-OS both are delivered through vendor hotfixes.","governanceImplications":"The federal model of patching plus forensic triage is a ready-made standard state and local policies can adopt.","securityPrivacyImplications":"Root-level webshells on perimeter devices put traffic and stored credentials at risk.","caveats":"Federal requirement only; entry does not name PAN-OS or any victim; due date is federal and passes on Oct. 31, 2026.","streamIds":["palo-alto-networks"],"roles":{"sales":"Sales framing: CISA’s catalog entry confirms that the kernel flaw used in the Palo Alto firewall chain is exploited, and it flags forensic triage as required for federal agencies. The customer problem for state, local and education teams is that they have no matching mandate and often no triage capacity. A bounded engagement could be a compromise assessment for previously exposed PAN-OS devices. The entry does not name Palo Alto or any victim, so it cannot support claims about who was breached.","engineering":"Engineering framing: the chain requires PHP2Shell for initial access and Fragnesia for root, so remediation on PAN-OS depends on the vendor hotfixes that address the exploited chain. For other Linux systems running PHP, kernel and PHP fixes are separate actions. Validate by confirming fixed builds, then perform forensic triage on any device exposed before patching: check for webshells, reverse tunnels and unexpected accounts. Record the triage outcome alongside the patch record for audit.","delivery":"Delivery framing: adopt the federal pattern locally by adding a forensic-triage step to the PAN-OS patch workflow. The security office owns triage and the network team owns patching. Proposed acceptance is a triage result recorded for every device that was internet-exposed before its hotfix, with escalation paths to the state fusion center or MS-ISAC. Risks include lack of in-house forensic skill, delayed triage after evidence is overwritten, and treating the federal due date as irrelevant to local timelines."},"roleDetails":{"sales":{"customerProblem":"State, local and education teams lack a mandate and capacity for the forensic triage CISA requires of federal agencies.","stakeholders":["State CISOs","County and city IT directors","University security officers","State cyber program managers"],"discoveryQuestions":["Which PAN-OS devices were internet-exposed before their hotfix?","Who can perform forensic triage on a firewall?","Does local policy require a compromise check after KEV patching?"],"valueHypothesis":"Interpretation: following the federal triage model can find compromises that patching alone would leave in place.","potentialEngagement":"A compromise assessment for previously exposed devices, aligned to the KEV triage expectation.","unsupportedClaims":["That PAN-OS is named in the entry","That any SLED organization was compromised","That the federal due date binds non-federal entities"]},"engineering":{"fit":"Relevant to any SLED entity with PAN-OS or other Linux-based systems running PHP.","architectureIntegration":"Ties KEV-driven patch workflows to incident-response procedures.","prerequisites":["Exposure history per device","Log and configuration access","Triage tooling or retainer"],"constraints":["BOD 26-04 applies only to federal civilian agencies","Evidence may be lost if triage is delayed"],"security":"Root webshells on perimeter devices require full credential rotation after confirmed compromise.","proofOfValue":["Confirm fixed builds","Run triage checklist on exposed devices","Record outcomes for audit"]},"delivery":{"work":"Add forensic triage to the PAN-OS and PHP patch workflow and execute it for exposed devices.","dependencies":["Triage capability","Logs retained from early October","Escalation contacts"],"ownership":"The security office owns triage; network operations owns patching.","skillsAdoption":"Teams may need outside incident-response help or state program support.","governanceCheckpoints":["Triage completed before closure","Escalation decision recorded"],"acceptanceCriteria":["Proposed: triage result recorded for 100% of previously exposed devices","Proposed: policy updated to require triage for KEV items flagged for it"],"risks":["No in-house forensic skill","Evidence overwritten before triage","Local timelines lag federal ones"]}},"retrievedAt":"2026-10-31T03:03:30Z","enrichedAt":"2026-10-31T03:08:50Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Forensic triage needs skills many small SLED teams must buy in.","procurementImplications":"Incident-response retainers and state cyber programs may be needed to meet a triage expectation.","operatingModelImplications":"Add a compromise-check step to KEV-driven patch workflows.","sourceVerification":{"openedUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-46300","referenceExcerpt":"This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}