1. Forum
  3. Main Forum
  5. English Section
  7. Server Security
  9. CWP7 Security Alert: Hackers Chain PHP2Shell and Linux Kernel CVE-2026-46300 to
× Presentation and instructions about security tools used to prevent server hacking. Feel free to use them or ask us to protect your site hosting it to a safe, daily monitored vps senter. Freespirits will ensure great quality of services.

CWP7 Security Alert: Hackers Chain PHP2Shell and Linux Kernel CVE-2026-46300 to

Περισσότερα
4 Ημέρες 20 Ώρες πριν #357 από infogate
CWP7 Security Alert: Hackers Chain PHP2Shell and Linux Kernel CVE-2026-46300 to δημιουργήθηκε από infogate
CRITICAL SECURITY WARNING: PHP2SHELL + LINUX KERNEL EXPLOIT CHAIN

Published: October 29, 2026
Security Classification: High Priority
Primary Vulnerability: CVE-2026-46300
Related Vulnerabilities: CVE-2026-109618, CVE-2026-109619
Affected Components: Linux Kernel and PHP
Exploitation Status: Confirmed
CISA KEV Addition: October 28, 2026



1. IMPORTANT SECURITY DEVELOPMENT

CISA has confirmed active exploitation of CVE-2026-46300, a Linux kernel privilege-escalation vulnerability known as Fragnesia.

The vulnerability can allow an attacker with limited local privileges to obtain root-level access.

This development is particularly concerning because attackers have demonstrated a working exploit chain combining:
  • PHP2Shell remote code execution.
  • Linux kernel privilege escalation.
  • Root-level access.
  • Persistent malicious webshell deployment.

The PHP vulnerabilities involved are:

CVE-2026-109618
CVE-2026-109619

The Linux kernel vulnerability is:

CVE-2026-46300

IMPORTANT:

These vulnerabilities are not specific to Control Web Panel.

However, CWP7 servers using affected PHP runtimes and vulnerable Linux kernels may be exposed.



2. CONFIRMED REAL-WORLD EXPLOITATION

On October 26, 2026, Dream Research published an investigation describing a campaign that compromised 25 servers.

The attackers combined PHP2Shell with the Fragnesia Linux kernel exploit.

The reported campaign involved:
  • Exposed firewall management interfaces.
  • Remote code execution through vulnerable PHP.
  • Privilege escalation to root.
  • Installation of malicious PHP webshells.
  • Reverse SSH tunnels.
  • Systemd-based persistence.
  • Unauthorized access to internal management infrastructure.

The researchers reported that 24 perimeter firewalls and one internal management server were compromised.

The affected firewall vendor and product versions were not publicly disclosed.

There is currently no evidence in this report that the attackers specifically targeted Control Web Panel.

Nevertheless, the exploit chain demonstrates the danger of combining an exposed PHP application with an unpatched Linux kernel.



3. HOW THE ATTACK WORKS

The attack combines two different vulnerability classes.

Stage 1 — Remote Code Execution

An attacker exploits vulnerable PHP request processing to execute commands under the permissions of the affected application.

Stage 2 — Local Privilege Escalation

The attacker then exploits CVE-2026-46300 in the Linux kernel.

The vulnerability involves improper handling of shared memory fragments during network packet processing.

Under vulnerable conditions, this can allow unauthorized modification of page-cache-backed data.

Stage 3 — Root Access

Successful exploitation can allow the attacker to modify privileged system behavior and obtain root access.

Stage 4 — Persistence

Attackers may install malicious scripts, webshells or persistent network tunnels to maintain unauthorized access.

IMPORTANT:

The precise exploitation requirements depend on the operating system, kernel configuration and application environment.

A vulnerable kernel does not automatically mean that a server has been compromised.



4. AFFECTED SYSTEMS

Red Hat has confirmed that affected kernel builds exist in:
  • Red Hat Enterprise Linux 8.
  • Red Hat Enterprise Linux 9.
  • Red Hat Enterprise Linux 10.

Administrators using AlmaLinux, Rocky Linux or other RHEL-compatible distributions should verify the security status of their installed kernel packages.

Distribution kernels frequently contain backported security fixes.

Therefore, the kernel version number alone is insufficient to determine vulnerability status.

Recommended action:

Verify that the running kernel contains the vendor fix for CVE-2026-46300.



5. SAFE SERVER INVESTIGATION

The following commands are read-only.

They do not change system configurations, install packages or restart services.

Step 1 — Identify the running kernel

echo "===== RUNNING KERNEL ====="
uname -r

echo
echo "===== INSTALLED KERNELS ====="
rpm -q kernel-core


Step 2 — Examine kernel security history

echo "===== KERNEL SECURITY HISTORY ====="

rpm -q --changelog kernel-core 2>/dev/null |
grep -Ei -m 10 \
'CVE-2026-46300|Fragnesia|shared.frag|skb_try_coalesce' || true


Step 3 — Check SELinux

echo "===== SELINUX STATUS ====="

getenforce 2>/dev/null


Step 4 — Inspect IPsec modules

echo "===== IPSEC MODULES ====="

lsmod | grep -E '^(esp4|esp6)\b' || true


Step 5 — Check unprivileged user namespaces

echo "===== USER NAMESPACES ====="

sysctl user.max_user_namespaces


Step 6 — Examine sensitive authentication configuration

echo "===== PAM CONFIGURATION ====="

grep -nE \
'pam_permit\.so|pam_rootok\.so|pam_wheel\.so' \
/etc/pam.d/su 2>/dev/null

echo
echo "===== PAM PACKAGE VERIFICATION ====="

rpm -V pam 2>/dev/null || true


Step 7 — Review recent systemd configuration changes

echo "===== RECENT SYSTEMD FILES ====="

find /etc/systemd/system \
-type f -mtime -14 -print |
head -50


IMPORTANT:

An empty result does not establish that a server is secure.

Administrators must verify installed vendor security patches and investigate suspicious findings individually.



6. INDICATORS OF POSSIBLE COMPROMISE

The reported campaign involved several persistence and post-exploitation techniques.

Administrators should investigate:
  • Unexpected PHP webshells in publicly accessible directories.
  • Unauthorized modifications to PAM authentication configuration.
  • Unexpected use of pam_permit.so.
  • Unknown systemd services.
  • Suspicious rc.local modifications.
  • Unexplained reverse SSH tunnels.
  • Unexpected outbound network connections.
  • New privileged accounts or unauthorized SSH keys.

The presence of an individual indicator does not prove exploitation.

No universal attacker-IP list or malware hash has been established for this exploit chain.

Preserve suspicious files and relevant logs before performing remediation.



7. RECOMMENDED IMMEDIATE PROTECTION

1. Patch the Linux kernel

Install the vendor security update addressing CVE-2026-46300.

Schedule a controlled reboot when required to activate the patched kernel.

2. Patch PHP

Install supported PHP releases containing the October 2026 PHP2Shell fixes.

Minimum upstream patched versions include:
  • PHP 8.2.35
  • PHP 8.3.36
  • PHP 8.4.27
  • PHP 8.5.12

Legacy PHP installations require verified vendor backports or migration.

3. Restrict administrative access

Limit SSH and CWP administrative interfaces to trusted networks or a management VPN.

Disable unnecessary external API exposure.

4. Maintain server protection
  • Keep CSF and LFD correctly configured.
  • Use maintained web application firewall rules.
  • Monitor suspicious file changes.
  • Investigate unexpected cron jobs and services.
  • Apply appropriate account isolation.
  • Maintain tested off-server backups.

5. Consider temporary kernel mitigations

Red Hat documents temporary mitigation options involving IPsec modules and unprivileged user namespaces.

These changes can disrupt legitimate services and must be evaluated before implementation.

They do not replace installing the corrected kernel.



8. OFFICIAL SECURITY REFERENCES

CISA Known Exploited Vulnerabilities

CISA KEV Catalog

Red Hat Security Bulletin

RHSB-2026-003 — Linux Kernel Privilege Escalation

Red Hat CVE Advisory

CVE-2026-46300 — Fragnesia

Original Incident Investigation

Dream Research — Chained PHP2Shell Exploit Roots 25 Servers

Official PHP Security Information

PHP Project



PROTECT YOUR CWP7 SERVER WITH FREESPIRITS

Professional CWP7 security monitoring, server protection and performance optimization.

Hosting environments face increasingly sophisticated threats involving malicious file injections, unauthorized access, webshells and resource abuse.

At FreeSpirits Web Services , we develop specialized modules designed to help CWP7 administrators strengthen monitoring, investigate suspicious activity and improve server reliability.

CWP7 SECURITY AUDIT MODULE

A dedicated security auditing and incident-investigation solution for Control Web Panel environments.
  • Website security auditing.
  • Suspicious and malicious file detection.
  • Monitoring potential file-injection activity.
  • Security incident reporting.
  • Malicious-file quarantine capabilities.
  • CSF integration for verified security incidents, subject to safety checks.

Discover the module:

CWP7 Security Audit Module — Features and Details



CWP7 RESOURCE SHIELD

A server protection solution designed to help control excessive resource consumption and improve hosting availability.
  • Resource activity monitoring.
  • Protection against excessive resource consumption.
  • Monitoring potentially abusive activity.
  • Integration with server protection mechanisms.

Discover the module:

CWP7 Resource Shield — Features and Details



CWP7 TWEAK MANAGER

Server configuration, security and maintenance utilities designed for CWP7 environments.
  • Server configuration checks.
  • Security-related maintenance utilities.
  • File permission management.
  • Network and mail configuration tools.

Discover the module:

CWP7 Tweak Manager — Features and Details



CWP7 TURBO MANAGER

A specialized performance and optimization solution for Control Web Panel hosting servers.
  • PHP-FPM configuration management.
  • PHP handler management.
  • Nginx caching and configuration utilities.
  • Server performance optimization.

Discover the module:

CWP7 Turbo Manager — Features and Details



NEED PROFESSIONAL CWP7 SECURITY ASSISTANCE?

If your hosting server is experiencing suspicious activity, malicious file injections, unexpected processes or unexplained performance problems, professional investigation can help identify the underlying cause.

FreeSpirits Web Services provides hosting, server administration and technical support services.

Explore Our CWP7 Solutions:

FreeSpirits Web Services — Official Website

Monitor threats. Strengthen security. Protect your hosting infrastructure.



Security Disclaimer: CVE-2026-46300 is a Linux kernel vulnerability. CVE-2026-109618 and CVE-2026-109619 are PHP vulnerabilities. They are not confirmed vulnerabilities in Control Web Panel itself. FreeSpirits modules provide specialized monitoring, auditing, security and optimization capabilities. They do not replace official security patches or guarantee protection against these vulnerabilities.

FreeSpirits Web Services
CWP7 Security | Server Protection | Hosting Solutions
fspirits.com/
The best possible way to start your online marketing : fspirits.com/go/leadsleap-home
Create Amazing AI Videos : fspirits.com/go/video-express-ai
Start your affiliate journey here: fspirits.com/go/olsp-academy
Edit And Create Videos: fspirits.com/go/create-studio-pro
Best Solution To Create Graphics: fspirits.com/go/artistly
Smart Chat Automation: fspirits.com/go/chatterpal
Multi-Purpose Video Maker: fspirits.com/go/avatar-builder
Multi-Purpose Video Creator: fspirits.com/go/videocreator
AI Human Spokesperson Videos: fspirits.com/go/humanpal

Παρακαλούμε Σύνδεση ή Δημιουργία λογαριασμού για να συμμετάσχετε στη συζήτηση.

  1. Forum
  3. Main Forum
  5. English Section
  7. Server Security
  9. CWP7 Security Alert: Hackers Chain PHP2Shell and Linux Kernel CVE-2026-46300 to
Χρόνος δημιουργίας σελίδας: 0.074 δευτερόλεπτα
Powered by Kunena Φόρουμ
Banner Image