CISA Warns of Fragnesia Linux Flaw as 319 Chrome Add-Ons Hijack Search

Active exploitation chaining a Linux kernel privilege escalation vulnerability with critical PHP remote code execution flaws, a massive browser search-hijacking campaign spanning 319 Chrome extensions, and hospital system recovery following a healthcare ransomware incident headlined cybersecurity reporting across the United States, Japan, Taiwan & South Korea on Thursday, October 29, 2026.

CISA Warns of Fragnesia Linux Kernel Bug Chained With PHP2Shell Flaws

As reported by BleepingComputer's Sergiu Gatlan, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Fragnesia Linux kernel vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday under Binding Operational Directive (BOD) 26-04 (with a Saturday 10 patch mandate) after CVE-2026-46300 paired with CVE-2026-109618 and CVE-2026-109619 rooted 25 servers:

• Vulnerability Mechanics & Kernel Scope: Tracked as CVE-2026-46300 in the Dirty Frag vulnerability class, Fragnesia stems from a logic flaw in the Linux XFRM ESP-in-TCP subsystem affecting Linux kernels before May 13, 2026; 40 custom post-exploitation scripts and PHP 8.4.26 honeypot hits were documented by researchers. CISA warned that attackers chain CVE-2026-46300 with the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619, added to CISA's KEV list Monday with a Thursday Federal Civilian Executive Branch deadline) "to implant PHP webshells and run commands as root."
• Dream Security & Perplexity Telemetry: In a Monday report, Dream Security analysts revealed that attackers used a custom weaponization of PHP2Shell and Fragnesia—complete with target lists, exploitation logs, and approximately 40 custom post-exploitation scripts—to gain root access on 25 servers across the United States, Japan, Taiwan, and South Korea, zeroing in on 3 servers in a U.S. government-affiliated environment. Separately, Perplexity security engineer Adel Karimi confirmed in-the-wild PHP2Shell exploitation over the weekend after honeypots recorded remote code execution against an Apache mod_php installation running PHP 8.4.26.

319 Unlisted Chrome Extensions With 13.4 Million Installs Caught Hijacking Searches

In browser security, BleepingComputer's Bill Toulas reported on a study by Socket researcher John Tuckner uncovering 319 unlisted Chrome extensions with 13.4 million installs (264 new add-ons with 8.7 million users) that quietly override default browser search engines to route queries through proxy servers to Bing and Yahoo for affiliate referral revenue:

• Expansion of April 2025 Campaign: Tuckner's report expands on his April 2025 discovery of 57 Chrome extensions with 6 million users by identifying 264 additional unlisted Chrome Web Store extensions with 8.7 million users. Using Chrome's built-in chrome_settings_overrides manifest property—sometimes with only a manifest and icons and zero background or content scripts—the extensions masquerade as PDF converters, manual finders, safe search utilities, and AI search tools promoted via website advertisements.
• Active Clusters & Proxy Redirection: The largest active clusters include "Bing-Search" (37 extensions with 2.2 million users, often promoted through Bidbrain ads) and "SecuryBrowse" (58 extensions with 4.9 million users, promoting add-ons such as Fire Shield, Securify, and WatchTower). Analyzing the Predator Search extension, Tuckner found that 6 identical queries sent through its proxy server landed in 4 different destinations—including Yahoo with partner tags (hspart=sz&hsimp=yhs-026), a landing page on searchlio.net, a hop through searchtosearch.com to mcftink.com before Yahoo, and a Cloudflare error page—warning that proxy operators can switch destinations at any time to phishing pages or malicious downloads.

University of New Mexico Restores Hospital Systems Without Paying Ransom

In healthcare cybersecurity, The Record's Jonathan Greig reported that the University of New Mexico Health Sciences Center (HSC) in Albuquerque restored all hospital, medical school, and biomedical research systems on Wednesday following a Monday cyberattack that forced ambulance diversions and outpatient surgery and class cancellations, as UNM refused ransom as BYOD demanded $2,500 from individuals; White House launched Project Lifeline 250:

• BYOD Extortion Warning & FBI Guidance: HSC—which operates New Mexico's only burn unit, children's hospital, and Level 1 trauma center—confirmed it did not pay a ransom after the BYOD ransomware group claimed responsibility Monday evening. On Tuesday, BYOD claimed it would offer decryption keys for free but threatened to retain stolen patient and employee data unless individuals contacted the group directly and paid $2,500 to destroy their personal information. HSC urged patients, students, and employees not to engage with the attackers and to report any contact to the FBI's Internet Crime Complaint Center.
• Federal Healthcare Cyber Response: The incident followed last week's cyberattack on University Hospitals in Cleveland, Ohio. On Monday, White House National Cyber Director Sean Cairncross unveiled Project Lifeline 250 at an event in South Carolina—a 6-month pilot pairing rural hospitals with Microsoft, Cisco, and Zscaler to provide free cybersecurity defenses, physical backup devices after incidents, and legacy device replacements.