Critical PHP2Shell exploit code released, botnet attacks underway

Key Takeaways

• Public exploit code for two critical PHP vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), has been released.
• Both vulnerabilities carry a CVSS score of 9.2, allowing unauthenticated remote code execution.
• Attackers are actively scanning for and attempting to exploit these flaws to deploy a Mirai-variant botnet, named Potassium.
• While attempts have been observed, security vendor Sophos reports no confirmed successful compromises of its customers via these specific vulnerabilities as of October 22, 2026.
• Patches for affected PHP versions (8.5.12, 8.4.27, 8.3.36, 8.2.35) were released on October 21, and immediate application is crucial.

Critical PHP2Shell Exploit Code Goes Public, Botnet Attacks Underway

Exploit code for a pair of severe PHP vulnerabilities, dubbed PHP2Shell, is now publicly available, leading to immediate attempts by threat actors to leverage these flaws for botnet deployment. These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, both boast a high CVSS severity score of 9.2, indicating their potential for unauthenticated remote code execution.

Cybersecurity firm Sophos confirmed that its telemetry shows scanning activity and a limited number of failed exploit attempts against its customer base. As of its latest update on October 22 at 21:21 UTC, Sophos has not observed any successful compromises directly resulting from these vulnerabilities. Researchers from Sophos identified the intended malicious payload as Potassium, a variant of the notorious Mirai botnet. Robust security controls successfully blocked these attempts, preventing the malware from being delivered.

Despite the unsuccessful delivery, analysis of the Potassium sample revealed a more sophisticated and updated version of the Mirai-derived threat, first observed earlier in 2026. This updated variant includes enhanced capabilities for downloading additional components and disrupting network services. This recent activity follows earlier, pre-patch targeting of PHP2Shell, with Amazon reporting observations dating back to October 17, four days prior to the official patch release. These early observations underscore the importance for defenders to review historical logs, carefully distinguishing between attempted attacks and confirmed successful code execution on live systems.

Understanding the PHP2Shell Vulnerabilities

PHP addressed these security issues with updates released on October 21. The vulnerabilities impact PHP installations that handle web requests through various mechanisms, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The Dutch National Cyber Security Centre highlights that Apache mod_php environments face the highest risk, as exploitation can occur even before the application code begins to execute.

The flaws stem from distinct memory and request data handling errors within PHP. Specifically, CVE-2026-109618 can lead to memory corruption during the request cleanup phase following an out-of-memory condition. CVE-2026-109619, conversely, concerns the persistence of old request data in shared internal state, which can then be inadvertently reused by a subsequent request processed by the same worker.

These weaknesses extend beyond individual websites, potentially affecting products that embed PHP, such as management interfaces and network appliances. These bundled solutions will require updates from their respective vendors. Administrators must therefore verify the runtime used by each service, rather than relying solely on the PHP version reported by a command-line check.

While public exploit code exists, it does not guarantee reliable compromise of every vulnerable server. Sophos’s research team noted that achieving successful exploitation proved challenging, even with AI assistance. Previous incidents involving Cloudflare and PHP attacks have also demonstrated that web application firewall rules serve as a temporary safeguard, not a definitive replacement for timely software updates.

Potassium Botnet Payload Analysis

The blocked attack traffic exhibited specific characteristics, including a scanning-related User-Agent, a multipart boundary, and a unique POST request pattern. Sophos provided indicators such as a temporary file path and an execution command. It is important to reiterate that, following the withdrawal of an earlier claim of success, these details should not be interpreted as evidence that customer systems successfully executed the payload.

Detailed analysis of the Potassium sample revealed its functionality: it resolves an encrypted command-and-control (C2) address and initiates an HTTP request. The malware then verifies a successful HTTP 200 response and checks if the returned file begins with Linux ELF magic bytes, indicating an expectation of another Linux executable rather than standard web content. The sample also incorporates hostname lookup and fallback resolution via public DNS services, which are not inherently malicious indicators. Like other Mirai-based malware, Potassium is designed to launch distributed denial-of-service (DDoS) attacks by flooding targets with traffic from compromised machines. This activity mirrors similar interests seen with other botnets, such as RondoDoX, in converting exposed application servers into resources for malicious campaigns.

What You Should Do

• Apply Patches Immediately: Update all PHP installations to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or install approved vendor backports.
• Restart Services: After patching, restart all affected services and verify that the patched code is actively in use by checking active workers.
• Inspect Bundled Runtimes: For products, containers, or appliances that bundle PHP, perform separate checks and apply updates from their suppliers, as updating a host package may not update embedded PHP instances.
• Enable and Update Protections: Ensure firewall and endpoint intrusion prevention signatures, including those provided by Sophos, are current and enabled.
• Monitor and Review Logs: Continuously monitor for unusual processes, unexpected outbound network connections, and suspicious web requests. Review older logs for signs of pre-patch exploitation attempts.
• Implement Network-Level Authentication: If immediate patching is not feasible, consider removing exposed PHP systems from direct internet access or placing them behind network-level authentication.
• Assess Alerts Carefully: While security alerts are crucial, assess them against comprehensive process and network evidence to determine if a successful compromise occurred, rather than relying solely on a blocked request.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.