Blue Arctic Security Bulletin: Fragnesia and Recent cPanel Security Updates
It has been a busy few weeks for Linux and web hosting security.
Following recent kernel level vulnerabilities like Copy Fail and Dirty Frag, another Linux kernel privilege escalation issue has now been disclosed: Fragnesia, tracked as CVE-2026-46300.
At the same time, cPanel has released multiple EasyApache 4 updates covering Apache, PHP, Tomcat, Redis, Valkey, nginx njs, ModSecurity, LSAPI, and related hosting stack components.
We want Blue Arctic customers to know this clearly:
Affected systems have already been reviewed, mitigated, patched, or updated as appropriate.
No customer action is required for standard managed hosting environments.
Fragnesia CVE-2026-46300
Fragnesia is a Linux kernel local privilege escalation vulnerability affecting certain CloudLinux environments.
According to CloudLinux, Fragnesia affects CloudLinux 7h, 8, 9, and 10, while CloudLinux 7 is not affected. CloudLinux also states that a working public proof of concept exists and that an unprivileged local user can use it to gain root in a single command on affected systems.
Blue Arctic reviewed this issue immediately.
Because Fragnesia follows closely behind Dirty Frag, the mitigation path was already familiar. Our team reviewed affected systems, validated mitigation status, and applied available updates where appropriate.
Recent cPanel EasyApache 4 Updates
In addition to the kernel level activity, cPanel has released several EasyApache 4 updates during May 2026.
These updates included security and maintenance fixes for:
- Apache HTTP Server
- PHP 8.2, 8.3, 8.4, and 8.5
- Tomcat
- Redis
- Valkey
- nginx njs
- ModSecurity
- LSAPI
- libcurl backports for older supported environments
cPanel’s May 2026 EasyApache 4 change log includes Apache 2.4.67 security fixes, PHP security updates across supported PHP versions, Tomcat 10.1 fixes, and additional updates for Redis, Valkey, nginx njs, ModSecurity, and LSAPI.
Blue Arctic has already applied the relevant updates across affected managed systems where appropriate.
What We Have Done
Over the last three weeks, our team has been actively reviewing and patching systems across the hosting stack.
That work has included:
- Reviewing affected CloudLinux and cPanel systems
- Applying kernel level mitigations where required
- Validating KernelCare protection where available
- Applying cPanel and EasyApache updates
- Updating supported PHP packages
- Updating Apache related packages
- Reviewing Tomcat, Redis, Valkey, ModSecurity, LSAPI, and related components
- Monitoring vendor advisories and release notes
- Verifying systems after updates
This is routine work for a managed hosting provider, but the volume of recent vulnerabilities has been higher than usual.
That is why we are posting this update.
Not to create alarm.
To let customers know we are already handling it.
Current Status
As of this update, affected Blue Arctic managed hosting systems have been reviewed, mitigated, patched, or updated as appropriate for the recent Fragnesia, cPanel EasyApache, Apache, PHP, Tomcat, Redis, Valkey, and related security releases.
We will continue monitoring vendor advisories and applying additional updates as they become available.
What Customers Need To Do
For standard Blue Arctic managed hosting customers, no action is required.
We have already reviewed and updated affected systems where appropriate.
If you manage your own application code, plugins, themes, custom software, or third party integrations, we still recommend keeping those updated as part of normal website maintenance.
Server level security is handled by Blue Arctic. Application level maintenance may depend on your specific service agreement.
Final Note
The last few weeks are a reminder that hosting security is active work.
It is not a one time setup.
It is not just a control panel update.
It is not something customers should have to manage alone.
Blue Arctic continues to monitor, patch, mitigate, and verify systems so customers can stay focused on their business.
That is managed hosting done properly.
