NEWS

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

Millions of PHP2Shell attempts try to drop the Mirai variant Potassium, but no successful RCE is confirmed. 34 million PHP services remain vulnerable.

Dylan H.

News Desk

October 23, 2026
3 min read
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

Overview

Attackers are mass-scanning for the newly disclosed PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2), and attempting to deliver a Mirai variant called Potassium. So far the attempts appear to be unsuccessful, and weaponizing the flaws may be harder than first thought.

The bugs sit in the PHP engine itself and allow unauthenticated remote code execution through crafted HTTP requests, so applications such as WordPress, Drupal or Joomla with clean code are still exposed. Sysdig says the vulnerable code dates back to PHP 5.4.

Exploitation Activity

  • Cloudflare saw tens of thousands of attempts 45 minutes after disclosure, rising to hundreds of thousands within two hours and millions by October 22.
  • Cisco Talos describes most activity as scanning and uncoordinated payload delivery.
  • Previdian, Wordfence, Beelzebub and Dataminr report scanning, fingerprinting and attempts to confirm command execution or steal credentials, but no confirmed RCE.
  • SOCRadar found PHP 8.4.26 exploit tooling and prerequisite-screening scripts on an attacker server, with no evidence of shell access to screened sites.
  • Hunt.io reports 123 targeted servers, none exploited.
  • VulnCheck developed a technique chaining the two bugs to defeat ASLR and achieve RCE on x86-64, even with PHP's recommended production error-display setting.
  • Censys counts more than 34.4 million PHP services still assessed as vulnerable as of October 23.

The Potassium Mirai Variant

First flagged by Synthient in March 2026, Potassium is delivered after a PHP2Shell attempt:

  • Fetches a Linux ELF payload from a loader at 92.118.112.100
  • Opens a C2 channel on TCP port 50792
  • Encrypts its static config table with ChaCha20 and uses a single-byte XOR key (0xED) for wire traffic (Nokia Deepfield)
  • Supports 24 commands covering ICMP, TCP, UDP and OpenVPN floods, plus Ethereum Name Service (ENS) C2 resolution code that was disabled in analyzed samples (Arctic Wolf)

The botnet's intended targets in analyzed samples were two adjacent hosts in a single Ukrainian network.

Mitigation

  1. Upgrade to a patched PHP release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
  2. PHP 7.4, 8.0 and 8.1 have no upstream fix. Move to a supported branch or use a distribution backport.
  3. Apply vendor patches to applications and web servers.
  4. Block the ENS names, RPC infrastructure and C2 addresses identified by Arctic Wolf.

Some government and enterprise sites were taken offline as a precaution during patching; the UK government reported 32 digital services unavailable and the NCSC issued about 50,000 warnings.

Source