From the Palo Alto Networks edition of October 30, 2026
CISA KEV adds Linux kernel Fragnesia (CVE-2026-46300), noting it can be chained with PHP2Shell to implant webshells as root, with forensic triage required and an Oct. 31 federal due date
Cybersecurity and Infrastructure Security Agency (CISA) · Federal cybersecurity agency / vulnerability catalog · United States
- Publisher
- CISA Known Exploited Vulnerabilities Catalog
- Original publication
- CISA Known Exploited Vulnerabilities Catalog entry added Oct. 28, 2026
- Source retrieved
- 2026-10-31
- Event date
- 2026-10-28
What happened
CISA added CVE-2026-46300 (Fragnesia) to the KEV catalog on Oct. 28, 2026 based on evidence of active exploitation, stating it can be chained with CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) to implant PHP webshells and run commands as root. The entry marks forensic triage as required under BOD 26-04 and sets a federal remediation due date of Oct. 31, 2026. The PHP2Shell entries were added on Oct. 26 with an Oct. 29 due date and also require forensic triage. The entry does not name Palo Alto Networks; the PAN-OS link comes from the Dream and Unit 42 reports archived in the Oct. 29 edition.
Why it matters
BOD 26-04 binds only federal civilian agencies, but CISA encourages all organizations to follow KEV. The forensic-triage flag is a federal signal that state, local and education teams should check for compromise before closing PAN-OS patch tickets.
Evidence and measured results
Opened and read the KEV catalog page entry for CVE-2026-46300, and checked dateAdded, dueDate, forensicTriage and description against the CISA KEV JSON feed (catalog version 2026.10.30). Also read the Oct. 28 CISA alert page, which lists the addition without the chaining note.
Limitations and uncertainty
Federal requirement only; entry does not name PAN-OS or any victim; due date is federal and passes on Oct. 31, 2026.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-31; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- State, local and education teams lack a mandate and capacity for the forensic triage CISA requires of federal agencies.
- Stakeholders
- State CISOs
- County and city IT directors
- University security officers
- State cyber program managers
- Discovery questions
- Which PAN-OS devices were internet-exposed before their hotfix?
- Who can perform forensic triage on a firewall?
- Does local policy require a compromise check after KEV patching?
- Value hypothesis
- Interpretation: following the federal triage model can find compromises that patching alone would leave in place.
- Potential engagement
- A compromise assessment for previously exposed devices, aligned to the KEV triage expectation.
- Unsupported claims
- That PAN-OS is named in the entry
- That any SLED organization was compromised
- That the federal due date binds non-federal entities
Pre-sales engineering
Role takeaway
- Fit
- Relevant to any SLED entity with PAN-OS or other Linux-based systems running PHP.
- Architecture and integration
- Ties KEV-driven patch workflows to incident-response procedures.
- Prerequisites
- Exposure history per device
- Log and configuration access
- Triage tooling or retainer
- Constraints
- BOD 26-04 applies only to federal civilian agencies
- Evidence may be lost if triage is delayed
- Security
- Root webshells on perimeter devices require full credential rotation after confirmed compromise.
- Proof of value
- Confirm fixed builds
- Run triage checklist on exposed devices
- Record outcomes for audit
Delivery
Role takeaway
- Work
- Add forensic triage to the PAN-OS and PHP patch workflow and execute it for exposed devices.
- Dependencies
- Triage capability
- Logs retained from early October
- Escalation contacts
- Ownership
- The security office owns triage; network operations owns patching.
- Skills and adoption
- Teams may need outside incident-response help or state program support.
- Governance checkpoints
- Triage completed before closure
- Escalation decision recorded
- Acceptance criteria
- Proposed: triage result recorded for 100% of previously exposed devices
- Proposed: policy updated to require triage for KEV items flagged for it
- Risks
- No in-house forensic skill
- Evidence overwritten before triage
- Local timelines lag federal ones
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
The chain needs both a PHP fix on the appliance and attention to the underlying Linux kernel; on PAN-OS both are delivered through vendor hotfixes.
Governance
Who approves, reviews and stays accountable for outcomes?
The federal model of patching plus forensic triage is a ready-made standard state and local policies can adopt.
Security and privacy
What data, permissions and controls need testing?
Root-level webshells on perimeter devices put traffic and stored credentials at risk.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Forensic triage needs skills many small SLED teams must buy in.
Procurement
What should contracts, pricing and exit terms secure?
Incident-response retainers and state cyber programs may be needed to meet a triage expectation.
Operating model
Which teams own the service once it runs?
Add a compromise-check step to KEV-driven patch workflows.
Publication history
- 2026-10-30Palo Alto Networks · Issue 026 resources
Stable resource ID: cisa-kev-cve-2026-46300-fragnesia-chained-with-php2shell-forensic-triage-20261028