PHP2Shell Attempts Reach Millions as Mirai Operators Seek Entry

Millions of exploit attempts have targeted the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, after their public disclosure. Cloudflare observed tens of thousands of attempts within 45 minutes, hundreds of thousands within two hours and millions by early October 22, 2026. The flaws carry CVSS scores of 9.2 and can enable unauthenticated remote code execution through specially crafted HTTP requests.

Attackers have tried to use the vulnerabilities to deploy Potassium, a Mirai-derived botnet variant, Sophos said. Yet multiple security firms reported no confirmed successful remote code execution in the activity they observed. The gap between extensive scanning and dependable exploitation is significant, but it does not reduce the urgency of applying the available updates.

Mirai payload activity targets PHP2Shell

Sophos analysed a Potassium sample that resolves an encrypted command-and-control address, connects to 134.199.154[.]64 and expects a Linux ELF payload after receiving an HTTP 200 response. The sample includes downloader and network-disruption functions and, like historical Mirai malware, can conduct DDoS attacks.

In a contained sandbox, the malware queried thunder.godofthunder[.]st, resolved it to the same address and opened a command-and-control channel on TCP port 50792. Sophos said the apparent objective was sustained volumetric flooding against two adjacent hosts in one Ukrainian network. Attack sources also contacted 92.118.112[.]100 to obtain a loader for the botnet.

Arctic Wolf found that the botnet supports 24 commands for ICMP, TCP, UDP and OpenVPN flood attacks. ARM and x86 builds contained code to resolve command-and-control infrastructure through Ethereum Name Service, although that capability was disabled in both analysed samples. Nokia Deepfield described Potassium as a Mirai fork using ChaCha20 for its static configuration table and a named reverse-shell protocol.

Exploitation tooling and persistent exposure

SOCRadar identified tooling labelled a one-click PHP2Shell exploit for PHP 8.4.26 running under Apache mod_php. Its operator used ordinary HTTP requests to recycle a PHP worker, leak memory addresses through a session cookie to bypass address space layout randomization, and abuse session upload progress handling to execute a shell command.

The associated scripts screened public websites for PHP versions, server configurations and session settings required by the chain. SOCRadar found no evidence of shell access on the sites examined as of October 22. Hunt.io likewise reported that an actor targeted 123 servers across cloud, shared-hosting and ISP networks, but none was exploited.

VulnCheck nevertheless said it developed a technique combining the two flaws to achieve remote code execution on ASLR-enabled x86-64 systems using PHP's recommended production error-display setting. Successful exploitation can execute code with the web application's permissions, potentially exposing API keys, database connections and services reachable by that application.

Patch supported PHP branches and map older estates

PHP fixed the vulnerabilities in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The vulnerable engine code dates to PHP 5.4, and Sysdig noted that exposure is not limited to insecure application code: WordPress, Drupal and Joomla deployments can be affected when running a vulnerable PHP engine.

VirusTotal estimates that about 272,000 hosts use supported PHP branches from 8.2 through 8.5. Censys detects more than 3.08 million hosts and 56.6 million web properties running PHP, with over 34.4 million PHP services still assessed as vulnerable on October 23. Organizations using PHP 7.4, 8.0 or 8.1 are advised to move to a supported branch or use a distribution backport.

Businesses should identify every internet-facing PHP service, verify its deployed engine version and apply the appropriate patched release or supported backport. They should also review logs for scanning and suspicious session-related requests, because widespread unsuccessful probing can rapidly become more capable exploitation when reliable techniques emerge.