Hunt.io Tracks PHP2Shell Attempts After Leaked PHP RCE Flaws, Finds No Confirmed Compromises

Oct 22, 2026 · Original article ↗

Summary

Hunt.io traced PHP2Shell scanning and staged exploit tooling after details of two critical PHP RCE flaws leaked before patches shipped. It found no confirmed compromises; turning the bugs into code execution reportedly remains difficult.

Key points

PHP released fixes for CVE-2026-109618 and CVE-2026-109619 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35; both flaws were rated CVSS v4.0 9.2.
The article describes the root cause as PHP core memory corruption during an out-of-memory bailout. Crafted multipart/form-data requests can trigger the vulnerable parsing path before application code runs.
Hunt.io says PHP2Shell scanning began about 20 minutes after the patch shipped. Its honeypots logged two requests from one IP; as of October 21, 2026, 23:45 UTC, it had no confirmed successful compromises.
AttackCapture contained PHP2Shell tooling in about ten workspaces. One mass-exploitation operator made ten runs against up to 123 servers and logged zero shells.
Hunt.io reports that public tools had not demonstrated reliable code execution on real x86-64 targets; its account says exploitation requires an additional weakness or a server without address-space randomization.
A one-day scan found 683,922 IPs exposing a PHP version in the X-Powered-By header. The article cautions that this is not a reliable count of vulnerable hosts because headers can be hidden and distributions may backport fixes without changing version strings.
The article recommends installing the fixed PHP releases; it says WAF rules can block some attempts but should be treated as a temporary layer, not a substitute for patching.

Article Details

Attack Vectors: Unauthenticated, oversized multipart/form-data requests can trigger memory exhaustion and the PHP core out-of-memory corruption behind CVE-2026-109618 and CVE-2026-109619.
Scanning and exploit attempts began after the patch was released; the article reports no confirmed successful php2shell compromise.
An established Mirai-style IoT botnet added php2shell to its scanning kit. The reported attempts and staged tooling do not establish successful exploitation.
Defensive Notes: Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35; confirm managed-hosting providers' patch timelines.
If patching is delayed, use a WAF as a temporary layer, not a substitute for patching. The article says Cloudflare's managed rules blocked some, but not all, attempts.
Inventory PHP hosts, plan upgrades for unsupported branches, and check whether distribution backports have been applied rather than relying only on version strings.
Disabling session.upload_progress is described as a useful stopgap, but the root cause is PHP's out-of-memory bailout handling.
Look for php2shell user-agents, multipart POSTs with PHP_SESSION_UPLOAD_PROGRESS and unusually large bodies, and bursts of PHP-FPM “Allowed memory size exhausted” errors. These indicate targeting, not proof of compromise.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`botlesscucks[.]st`	Wildcard domain listed as botnet C2 infrastructure.
DOMAIN	`gettingheadfromduckysmom[.]st`	Wildcard domain listed as botnet C2 infrastructure.
DOMAIN	`godofthunder[.]st`	Wildcard domain listed as botnet C2 infrastructure.
DOMAIN	`maste[.]mangsud[.]org`	Source host from which a staged PHP backdoor was described as pulling.
IPV4	`102[.]210[.]149[.]166`	Attacker workspace holding custom tooling and target lists; the operator also used it for an unrelated AVideo SQL injection.
IPV4	`104[.]219[.]251[.]31`	Staging host holding a cloned php2shell PoC and ready-to-drop PHP backdoors.
IPV4	`107[.]150[.]31[.]151`	Workspace where a php2shell PoC was held before the patch; the article reports no results.
IPV4	`122[.]10[.]110[.]72`	Operator workspace holding php2shell tooling; the article also reports a callback to this operator after a separate Java attack.
IPV4	`122[.]10[.]17[.]49`	Shared operator workspace holding php2shell tooling.
IPV4	`157[.]230[.]117[.]70`	Attacker workspace holding the same public php2shell tool as 41.223.30[.]7.
IPV4	`206[.]188[.]197[.]105`	Mass-exploitation server used in ten runs against up to 123 servers; no shells were logged.
IPV4	`41[.]223[.]30[.]7`	Attacker workspace holding reused public php2shell tooling.
IPV4	`45[.]198[.]224[.]169`	Scanner attributed to the Mirai-style IoT botnet adding php2shell to its spreading kit.
IPV4	`58[.]221[.]60[.]160`	Host staging probe scripts and scanners used for php2shell surface scanning.
IPV4	`85[.]11[.]167[.]243`	Reported as a second php2shell scanner.
IPV4	`89[.]32[.]41[.]16`	Identified as a botnet binary host.
IPV4	`89[.]32[.]41[.]50`	Identified as a botnet binary host.
IPV4	`92[.]118[.]112[.]100`	Identified in the article as a payload host.