Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought.
The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote code execution (RCE) via specially crafted HTTP requests. The vulnerabilities have been patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
"However, analysis of the sample revealed that it is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026," Sophos said. "The sample displays downloader and network disruption functionality."
Specifically, it resolves a hard-coded, encrypted command-and-control (C2) address, establishes a TCP connection to 134.199.154[.]64, and sends an HTTP request. The malware then checks for an HTTP 200 response status and verifies that the resulting payload begins with the ELF magic bytes 7F 45 4C 46, indicating that it expects a Linux ELF binary as a follow-on payload.
"A resolver function supports IPv4 addresses and hostname resolution, with additional fallback resolution logic that includes hard-coded public DNS servers such as 8.8.8.8, 1.1.1.1, and 1.0.0.1," Sophos added. "As with Mirai malware historically, this sample can execute DDoS attacks."
The attacks have been found to originate from the following three IP addresses -
- 85.11.167[.]243
- 217.60.242[.]76
- 45.198.224[.]169
These attack sources have been found to contact 92.118.112[.]100 to retrieve a loader, which is responsible for deploying the Mirai botnet variant. Further analysis of the artifact within a network-contained sandbox has revealed that the botnet issues a DNS query for thunder.godofthunder[.]st, resolves it to 134.199.154[.]64, and establish a C2 channel on TCP port 50792.
The end goal is to launch sustained volumetric flood attacks against two adjacent hosts located within a single Ukrainian network -
- 45.88.138[.]0
- 45.88.138[.]44
The lack of a successful attack leveraging PHP2Shell in the wild suggests that threat actors are "struggling" to come up with reliable exploits, Sophos added.
Potassium was first flagged by botnet tracking platform Synthient in March 2026. In a follow-up analysis, Nokia Deepfield researchers described the malware as a Mirai fork which uses "ChaCha20 for the static config table (the first time we have seen ChaCha20 used this way in a Mirai variant), a single static byte (0xED) for everything on the wire, a named reverse-shell protocol (SHELL / SHOUT) on the same channel as attack commands, and a DNS misdirection scheme that swaps the two 16-bit halves of every resolved A record before connect()."
Arctic Wolf, which also shared additional details of the same weaponized PHP2Shell exploitation attempt, said the botnet supports 24 commands to facilitate flood attacks over ICMP, TCP, UDP, and OpenVPN protocol. Both builds for ARM and x86 also contain configuration for resolving C2 infrastructure through Ethereum Name Service (ENS).
"ENS resolution was disabled in both samples, indicating that the capability was present but inactive," the cybersecurity firm said. "If enabled in future variants, it could complicate disruption by reducing reliance on registrars and DNS providers, requiring defenders to block the ENS names, RPC infrastructure, and resolved command-and-control addresses."
Threat Actor Mass Exploits PHP2Shell
The development comes as SOCRadar said it found PHP2Shell exploit tooling for PHP 8.4.26 on an exposed attacker-controlled server ("206.188.197[.]105:9999"), alongside three screening scripts that check live websites for preconditions the PHP2Shell chain depends on.
The scripts, according to the cybersecurity company, checked about 20 public websites for the PHP version, server setup, and session settings the exploit needs. These websites span Canada, China, Finland, France, Poland, the U.K., and the U.S.
"The central file, aslr_exploit.py, is a Python exploit the operator labels a 'one-click' PHP2Shell exploit for PHP 8.4.26 under Apache mod_php," SOCRadar said. "It works entirely over ordinary HTTP requests in three broad steps: it recycles the target's PHP worker, leaks memory addresses through the session cookie to defeat address space layout randomization (ASLR), and then abuses PHP's session upload progress handling to run a shell command."
ASLR, short for Address Space Layout Randomization, is a cybersecurity mechanism that randomizes the memory locations used by system files and programs each time they are run, making it harder for attackers to predict where code will load. This built-in defense helps defend against memory-based exploits, such as buffer-overflow attacks.
The other three companion scripts are as follows -
- php2shell_fp.py, which reads PHP version and server setup from about 20 sites
- deep_probe.py, which examines 11 of those sites for visible errors, phpinfo pages, file inclusion, and session injection to ascertain whether they meet exploit prerequisites
- wp_attack.py, which focuses on five WordPress sites to conduct user and plugin enumeration
That said, there is no evidence of shell access on any screened site as of October 22, 2026, indicating the targeted sites did not meet the exploit's preconditions.
The toolset is assessed to be part of a broader operation that involves the attacker extracting API keys and backend URLs from websites' client-side JavaScript, systematically sweeping web and API routes for unauthenticated access, and using a pool of rotating proxies to spread traffic and evade rate limits and blocking.
"Related artifacts on the server additionally point to web-archive reconnaissance and automated CAPTCHA solving," SOCRadar noted. "Taken together, the toolset points to a financially motivated actor focused on cryptocurrency and Web3 targets."
The same exploitation server ("206.188.197[.]105") has also been flagged by Hunt.io, which said the threat actor behind the operation has targeted 123 servers across cloud, shared-hosting and ISP networks. "About 57 run PHP, many on unsupported 5.x to 7.x," the threat intelligence firm said. "Ten rejected the request outright, including three of the five sitting behind Cloudflare. None was exploited."
In all, 10 open directories hold PHP2Shell-related tooling -
- 206.188.197[.]105
- 102.210.149[.]166
- 122.10.110[.]72, 122.10.17[.]49
- 58.221.60[.]160:8000
- 41.223.30[.]7, 157.230.117[.]70
- 104.219.251[.]31
- 107.150.31[.]151
- 217.160.132[.]82
- 47.100.125[.]108, 54.169.109[.]7, 139.162.165[.]136
Defeating ASLR Protections
The disclosure also coincides with the development of a PHP2Shell exploit that can achieve remote code execution on ASLR-enabled x86-64 systems with PHP's recommended production configuration.
"One of the biggest obstacles has been address space layout randomization (ASLR), a protection designed to make memory corruption vulnerabilities much harder to exploit," Spencer McIntyre, director of exploit development at VulnCheck, told The Hacker News.
"Our team developed a novel technique [...] that chains the two vulnerabilities together, using a memory leak to bypass ASLR and achieve remote code execution on x86-64 systems, even with PHP's recommended production error-display setting."ir
"We haven't identified another public or commercial exploit that achieves this under the same conditions. Developing this capability was far from trivial, but it demonstrates that a major barrier to exploiting PHP2Shell on production-configured systems can be overcome."
Consequences of successful exploitation of the flaws are severe, as it permits an attacker to execute code with the permissions of the web application, potentially gaining access to API keys, database connections, and other internal services the application can reach, VulnCheck said.
"An attacker doesn't necessarily need administrator or root access to cause significant damage," McIntyre said. "Access to a vulnerable web application could provide a foothold into other parts of an organization's infrastructure."
Exploit Attempts Plenty, None Successful
The findings also coincide with reports indicating broad exploitation attempts targeting the flaws are underway, including by a China-based IP address that has been observed trying to drop a web shell via a server-side session file.
Web infrastructure company Cloudflare said it observed tens of thousands of attempts to exploit the flaw 45 minutes after the flaws were publicly announced, before climbing to hundreds of thousands within 2 hours and millions as of early October 22, 2026.
"So far, most of the activity is scanning, along with some uncoordinated attempts to deliver various payloads," Cisco Talos said. "This is expected: scanning or basic exploitation with public proof-of-concept (PoC) code takes far less effort than integrating a vulnerability into an actor's own tooling."
Data from Previdian's telemetry has so far recorded hundreds of exploitation attempts targeting CVE-2026-109618 from dozens of IP addresses, and against CVE-2026-109619 to a lesser degree. The first exploit event aimed at CVE-2026-109618 was recorded on October 21, 2026, at 1:05 p.m. UTC.
"We've seen plenty of php2shell probes and exploitation attempts in our honeypots," Previdian said. "At the time of writing, we've observed no successful remote code execution and no dropped PHP files. Reliable RCE may be harder to achieve than initially expected."
This assessment has also been echoed by Beelzebub, Dataminr, and Wordfence, with observed activity so far limited to scanning, fingerprinting, and attempts to confirm command execution, steal credentials and secrets from environment variables, install persistent access, and retrieve and execute a second-stage payload.
Wordfence has shared the following IP addresses as among those attempting to exploit the flaws -
- 87.121.84[.]174
- 181.215.186[.]252
- 185.196.220[.]132
- 185.161.210[.]29
- 152.233.51[.]69
- 45.134.225[.]16
- 107.189.14[.]87
- 193.47.62[.]24
- 2409:40d2:204e:4be:2a1f:f9c9:a055:e00b
- 103.147.220[.]17
The severity of the flaws has also led to several government, school and hospital websites going offline across Asia, Europe, and North America out of an abundance of caution. The U.K. government has confirmed that 32 digital services are unavailable and four are partially unavailable, largely stemming from the precautionary shutdowns while security updates and mitigations were applied. The National Cyber Security Centre (NCSC) has issued approximately 50,000 warnings to businesses and other organizations.
"The vulnerable code dates back to PHP 5.4, released in 2012," the Sysdig Threat Research Team said. "The bugs live in the PHP engine, not within any application. For that reason, any WordPress, Drupal, or Joomla site with clean application code is still exposed."
With the fixes not available for older versions of PHP, PHP2Shell is expected to have a long tail, along the lines of Log4Shell. According to estimates from Google-owned VirusTotal, about 272,000 hosts run a supported PHP branch (8.2 to 8.5), Organizations on PHP 7.4, 8.0, or 8.1 are advised to move to a supported branch, or use a distribution backport.
Attack surface management platform Censys said it currently detects over 3.08 million hosts and 56.6 million web properties running PHP. Of these, more than 34.4 million PHP services are still assessed to be vulnerable as of October 23, 2026.
"Many applications with web servers and similar will likely remain vulnerable until their respective vendors patch these items," Dataminr said. "The implications of this are that many organizations will likely remain vulnerable to some degree for far longer than when patches are directly applied to owned and managed applications."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.