VulnCheck Reports PHP2Shell ASLR Bypass as Mirai Exploitation Attempts Emerge
Summary
Attackers have attempted to exploit PHP2Shell flaws, including in Mirai-related activity, but no successful compromise is confirmed. VulnCheck reports an ASLR-bypassing exploit, while researchers describe significant configuration hurdles and patching gaps.
Key points
- PHP patched CVE-2026-109618 and CVE-2026-109619, critical unauthenticated remote code execution flaws, on October 21.
- Sophos says a PHP2Shell attempt to install the Mirai-derived Potassium malware was stopped; other firms also report attempts but no confirmed compromise.
- VulnCheck says its CVE-2026-109618 exploit uses a memory leak to achieve code execution on x86-64 systems with ASLR enabled and PHP error display disabled.
- SOCRadar and Hunt.io described attacker tooling and target probing, but reported no successful exploitation; the observed exploit chain required uncommon configurations.
- Qualys reported that 199,000 PHP instances were patched within 12 hours of disclosure, while many instances run end-of-life PHP versions or supported but unpatched versions.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution
- Severity
- Critical (CVSS v4.0 9.2)
- Affected Versions
- PHP 8.4.26
- Exploitation Status
- reported
- Exploit Availability
- public_exploit
- Patch Status
- available
MITRE ATT&CK
T1105 · Ingress Tool TransferSophos described Potassium as capable of downloading additional malware.T1190 · Exploit Public-Facing ApplicationThreat actors attempted to exploit PHP2Shell on internet-facing PHP servers; no successful compromise was confirmed.T1498 · Network Denial of ServiceSophos described Potassium as capable of launching DDoS attacks.T1595.002 · Vulnerability ScanningThe operator fingerprinted websites and used scripts to check whether their configurations met the exploit chain's requirements.
CVE
CVE-2026-109618PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical bugs in the PHP engine that can be exploited for unauthenticated remote code execution.CVE-2026-109619PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical bugs in the PHP engine that can be exploited for unauthenticated remote code execution.
Malware
Products
Countries
CanadaThe operator fingerprinted about 20 websites in countries including the US, UK, Canada, France, Finland, Poland and China, and probed 11 of them in more depth.ChinaThe operator fingerprinted about 20 websites in countries including the US, UK, Canada, France, Finland, Poland and China, and probed 11 of them in more depth.FinlandThe operator fingerprinted about 20 websites in countries including the US, UK, Canada, France, Finland, Poland and China, and probed 11 of them in more depth.FranceThe operator fingerprinted about 20 websites in countries including the US, UK, Canada, France, Finland, Poland and China, and probed 11 of them in more depth.PolandThe operator fingerprinted about 20 websites in countries including the US, UK, Canada, France, Finland, Poland and China, and probed 11 of them in more depth.United KingdomSeveral government, school and hospital websites in Europe went dark on October 21, and the UK government said 32 of its services were unavailable and four partly unavailable, mostly due to precautionary measures takenUnited StatesThe operator fingerprinted about 20 websites in countries including the US, UK, Canada, France, Finland, Poland and China, and probed 11 of them in more depth.