PHP2Shell Exploit Attempts Reach Millions, but No In-the-Wild RCE Reported
Summary
Researchers report millions of PHP2Shell exploit attempts, but no successful in-the-wild RCE in observed campaigns. Separately, VulnCheck demonstrated RCE on production-configured x86-64 systems; some attempts sought to deploy Mirai variant Potassium.
Key points
- CVE-2026-109618 and CVE-2026-109619 can enable unauthenticated RCE via crafted HTTP requests; fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- Cloudflare reported millions of exploit attempts. Activity was largely scanning; Previdian reported no successful RCE or dropped PHP files in its observations.
- VulnCheck demonstrated RCE on x86-64 systems with PHP's recommended production configuration, using a memory leak to bypass ASLR. SOCRadar found screening scripts, but reported no evidence of shell access on the roughly 20 sites checked.
- Sophos analyzed unsuccessful exploitation attempts aimed at deploying Potassium, a Mirai-derived botnet variant with downloader and network-disruption functionality.
- Arctic Wolf said Potassium supports 24 flood-attack commands; its samples included Ethereum Name Service resolution configuration, which was disabled.
- Censys assessed more than 34.4 million PHP services as vulnerable as of October 23, 2026.
- The U.K. government reported 32 digital services unavailable and four partially unavailable after precautionary shutdowns; the NCSC issued about 50,000 warnings.
Article Details
- Event Type
- Mass exploitation attempts targeting the PHP2Shell vulnerabilities, including attempts to deploy a Mirai botnet variant.
- Impact
- Millions of exploit attempts were reported, but the article reports no successful remote code execution in the observed activity. Attempts sought to deploy the Potassium botnet, which can conduct volumetric DDoS attacks. Precautionary shutdowns left 32 U.K. government digital services unavailable and four partially unavailable; more than 34.4 million PHP services were assessed as vulnerable.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | thunder[.]godofthunder[.]st | C2 hostname queried by the botnet and resolved to 134.199.154[.]64. |
| IPV4 | 134[.]199[.]154[.]64 | C2 address used by the Potassium botnet after resolving its C2 hostname. |
| IPV4 | 206[.]188[.]197[.]105 | Attacker-controlled server hosting PHP2Shell exploit tooling and screening scripts. |
| IPV4 | 92[.]118[.]112[.]100 | Host contacted by the attack sources to retrieve a loader used to deploy the Mirai botnet variant. |
MITRE ATT&CK
T1105 · Ingress Tool TransferThe malware retrieves a loader used to deploy the botnet variant.T1190 · Exploit Public-Facing ApplicationAttackers attempted to exploit PHP2Shell vulnerabilities in internet-facing PHP systems.T1498 · Network Denial of ServiceThe botnet supports sustained volumetric flood attacks against hosts.
CVE
CVE-2026-109618The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote code execution (RCE) via specially crafted HTTP requests. The vulnerabilities have beenCVE-2026-109619The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote code execution (RCE) via specially crafted HTTP requests. The vulnerabilities have been
People
Malware
Miraiattempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previouslyPotassiumnewly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought.
Vendors
Arctic WolfArctic Wolf, which also shared additional details of the same weaponized PHP2Shell exploitation attempt, said the botnet supports 24 commands to facilitate flood attacks over ICMP, TCP, UDP, and OpenVPN protocol. BothCisco Talosmost of the activity is scanning, along with some uncoordinated attempts to deliver various payloads," Cisco Talos said. "This is expected: scanning or basic exploitation with public proof-of-concept (PoC) code takesCloudflareintelligence firm said. "Ten rejected the request outright, including three of the five sitting behind Cloudflare. None was exploited."Hunt.ioThe same exploitation server ("206.188.197[.]105") has also been flagged by Hunt.io, which said the threat actor behind the operation has targeted 123 servers across cloud, shared-hosting and ISP networks. "About 57 runSOCRadarThe development comes as SOCRadar said it found PHP2Shell exploit tooling for PHP 8.4.26 on an exposed attacker-controlled server ("206.188.197[.]105:9999"), alongside three screening scripts that check live websitesSophosupdated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026," Sophos said. "The sample displays downloader and network disruption functionality."VulnCheckvulnerabilities much harder to exploit," Spencer McIntyre, director of exploit development at VulnCheck, told The Hacker News.WordfenceThis assessment has also been echoed by Beelzebub, Dataminr, and Wordfence, with observed activity so far limited to scanning, fingerprinting, and attempts to confirm command execution, steal credentials and secrets
Products
Apache mod_phpis a Python exploit the operator labels a 'one-click' PHP2Shell exploit for PHP 8.4.26 under Apache mod_php," SOCRadar said. "It works entirely over ordinary HTTP requests in three broad steps: it recycles thePHPremote code execution (RCE) via specially crafted HTTP requests. The vulnerabilities have been patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Tools
Countries
Canadawebsites for the PHP version, server setup, and session settings the exploit needs. These websites span Canada, China, Finland, France, Poland, the U.K., and the U.S.Chinafor the PHP version, server setup, and session settings the exploit needs. These websites span Canada, China, Finland, France, Poland, the U.K., and the U.S.FinlandPHP version, server setup, and session settings the exploit needs. These websites span Canada, China, Finland, France, Poland, the U.K., and the U.S.Franceserver setup, and session settings the exploit needs. These websites span Canada, China, Finland, France, Poland, the U.K., and the U.S.Polandserver setup, and session settings the exploit needs. These websites span Canada, China, Finland, France, Poland, the U.K., and the U.S.United Kingdomand session settings the exploit needs. These websites span Canada, China, Finland, France, Poland, the U.K., and the U.S.United Statessettings the exploit needs. These websites span Canada, China, Finland, France, Poland, the U.K., and the U.S.
Industries
CryptocurrencySOCRadar noted. "Taken together, the toolset points to a financially motivated actor focused on cryptocurrency and Web3 targets."GovernmentThe severity of the flaws has also led to several government, school and hospital websites going offline across Asia, Europe, and North America out of an abundance of caution. The U.K. government has confirmed that 32Web3noted. "Taken together, the toolset points to a financially motivated actor focused on cryptocurrency and Web3 targets."