Arctic Wolf Analyzes PHP2Shell Exploitation Attempts and Potassium Botnet Samples

Summary

Arctic Wolf reports widespread scanning and attempted command execution after disclosure of PHP2Shell CVE-2026-109618 and CVE-2026-109619, and links payload-hosting infrastructure to Potassium. Telemetry did not confirm successful exploitation at scale.

Key points

CVE-2026-109618 and CVE-2026-109619 can enable unauthenticated remote code execution; both have a CVSS v4.0 score of 9.2.
Affected deployments include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed, and products embedding PHP. Recommended fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Arctic Wolf observed scans using canaries, session-poisoning and file-inclusion chains, and command-execution checks. Request telemetry alone does not establish that a target was vulnerable or code execution succeeded.
A likely weaponized request attempted to collect host and process information and download files from 92.118.112[.]100; telemetry did not establish that the files were retrieved or executed.
Arctic Wolf linked ARM and x86-64 binaries hosted on associated infrastructure to the Potassium botnet. Shared encryption key and nonce values suggest a common builder, but the observed PHP2Shell requests were not shown to download or execute the samples.
The samples contained Ethereum Name Service command-and-control resolution configuration, but that capability was disabled in both builds.

Article Details

Attack Vectors: Unauthenticated requests targeting PHP request-processing weaknesses in CVE-2026-109618 and CVE-2026-109619; Apache mod_php was reported as the clearest high-risk configuration.
Some requests attempted to poison PHP session upload-progress data and evaluate it through local file inclusion; the article notes that this approach required additional application-specific conditions.
Observed payloads attempted to run operating-system commands, print execution markers, and retrieve second-stage files with wget.
The Potassium samples contain multiple UDP, TCP, and raw-socket flood attack vectors, including SYN, ACK, ICMP, and GRE variants.
Defensive Notes: Update affected PHP installations to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, then restart the relevant workers.
For unsupported PHP versions, use an appropriate vendor or upstream backport, or migrate to a supported branch.
Monitor for command execution and second-stage payload delivery. The article cautions that request telemetry alone does not establish successful exploitation.
Do not assume every PHP2Shell-themed request exploits the newly disclosed vulnerabilities; some observed requests appeared to use older session-poisoning or deserialization techniques.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`hackattackkaboom[.]botlesscucks[.]st`	Update domain configured in both analyzed Potassium samples.
DOMAIN	`thunder[.]godofthunder[.]st`	Command-and-control domain configured in both analyzed Potassium samples.
IPV4	`92[.]118[.]112[.]100`	Payload-hosting IP used by likely weaponized requests to retrieve second-stage files.
SHA256	`0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486`	Hash listed as an IOC for a malicious binary associated with the Potassium botnet.
SHA256	`e2529d4afa39ae4db2eb05d5176317c906289abf09660c75bdeec43e54c55aa3`	Hash listed as an IOC for a malicious binary associated with the Potassium botnet.
URL	`hxxp[:]//45[.]115[.]26[.]26:8000/cCmono`	Remote second-stage payload URL targeted by a serialized Monolog gadget-chain request; the article says the file could not be retrieved or independently verified.
URL	`hxxp[:]//92[.]118[.]112[.]100/mountpoint`	Additional payload URL listed among the article's IOCs for the associated payload-hosting infrastructure.
URL	`hxxp[:]//92[.]118[.]112[.]100/nfs-setup`	Payload URL used in a likely weaponized PHP2Shell request to retrieve a second-stage file.