PHP2Shell attempts surge as reliable RCE remains elusive
PHP2Shell exploit attempts have reached millions of requests, but several security companies say they have not yet observed reliable remote code execution in the wild. The two underlying flaws, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS severity score of 9.2 and can allow an unauthenticated attacker to run code by sending specially constructed web requests. PHP has fixed them in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Sophos examined unsuccessful attempts to use the vulnerabilities to install Potassium, an expanded variant of the Mirai malware family. The sample can download additional software and conduct distributed denial-of-service attacks, commonly called DDoS attacks, which overwhelm a target with traffic. It decrypts a built-in command-and-control address, connects to 134.199.154[.]64 and checks that the downloaded payload is a Linux ELF executable. Its address resolver can use public DNS services at 8.8.8.8, 1.1.1.1 and 1.0.0.1 if its other resolution methods fail.
Sophos traced the attempts to 85.11.167[.]243, 217.60.242[.]76 and 45.198.224[.]169. Those systems contacted 92.118.112[.]100 for a loader that deployed the botnet sample. In an isolated test environment, the malware queried thunder.godofthunder[.]st, reached 134.199.154[.]64 and opened a control channel over TCP port 50792. Its configured objective was sustained traffic floods against 45.88.138[.]0 and 45.88.138[.]44, two nearby hosts on one Ukrainian network. Sophos said the absence of successful PHP2Shell attacks indicated that attackers were having difficulty producing dependable exploits.
Potassium was initially identified by the botnet-tracking platform Synthient in March 2026. Nokia Deepfield subsequently described it as a Mirai fork using ChaCha20 encryption for its stored configuration, the byte 0xED for network communications, and a reverse-shell protocol named SHELL / SHOUT on the same channel as attack instructions. It also rearranges the two halves of resolved IPv4 addresses before connecting. Arctic Wolf found 24 commands supporting floods over ICMP, TCP, UDP and OpenVPN. ARM and x86 builds contained an inactive option for resolving control infrastructure through Ethereum Name Service, or ENS. Arctic Wolf warned that activating it could make disruption more complicated by adding ENS names and associated infrastructure to the systems defenders must block.
Separate research illustrates how attackers are trying to make PHP2Shell practical. SOCRadar found exploit tools for PHP 8.4.26 on an exposed server at 206.188.197[.]105:9999. Its central Python program was presented by its operator as a one-click exploit for Apache mod_php. It attempts to recycle a PHP worker process, disclose memory addresses through a session cookie and abuse PHP session upload progress handling to execute a shell command. The address disclosure is intended to bypass Address Space Layout Randomization, or ASLR, a defence that moves programs and system components to unpredictable memory locations.
Three accompanying scripts profiled about 20 public websites. One collected PHP versions and server configurations, another examined 11 sites for exposed errors, phpinfo pages, file inclusion and session injection, and a third enumerated users and plugins on five WordPress sites. As of October 22, 2026, SOCRadar found no evidence that any screened site had yielded shell access. The wider toolset also extracted API keys and backend addresses from browser-delivered JavaScript, searched websites and application programming interface routes for access without authentication, rotated proxies to spread requests, examined web archives and automated CAPTCHA solving. SOCRadar assessed the operator as financially motivated and focused on cryptocurrency and Web3 targets.
Hunt.io linked the same exploitation server to targeting against 123 systems across cloud, shared-hosting and internet service provider networks. About 57 ran PHP, including many using unsupported branches from PHP 5.x through 7.x. Ten systems rejected the requests, including three of five protected by Cloudflare, and Hunt.io found that none had been exploited. It also identified PHP2Shell tools distributed through 10 open directories on multiple servers.
Research from VulnCheck nevertheless shows that the exploitation barrier can be overcome. Its team developed a chain combining both vulnerabilities, using a memory disclosure to bypass ASLR and obtain remote code execution on x86-64 systems with PHP's recommended production error-display configuration. VulnCheck said it had not identified another public or commercial exploit working under the same conditions. Successful exploitation would run code with the web application's permissions, potentially exposing API keys, database connections and internal services that the application can reach. Root or administrator privileges would not be necessary for an attacker to establish a useful foothold.
Internet-wide activity escalated quickly after disclosure. Cloudflare recorded tens of thousands of attempts within 45 minutes, hundreds of thousands within two hours and millions by early October 22, 2026. Cisco Talos characterized most observed traffic as scanning and uncoordinated payload delivery. Previdian recorded hundreds of attempts against CVE-2026-109618 from dozens of addresses, with less activity against CVE-2026-109619; its first event involving the former occurred on October 21 at 1:05 p.m. UTC. Previdian's honeypots showed no successful code execution or uploaded PHP files. Beelzebub, Dataminr and Wordfence similarly reported scanning, fingerprinting and attempts to test command execution, collect secrets from environment variables, establish persistence or download another payload, rather than confirmed compromises.
Some government, school and hospital websites in Asia, Europe and North America were taken offline as a precaution while updates and mitigations were applied. The U.K. government confirmed 32 unavailable digital services and four partially unavailable services, largely because of precautionary shutdowns, while the National Cyber Security Centre issued about 50,000 warnings. These outages were protective measures and are not evidence that the affected services were successfully exploited.
Sysdig noted that the vulnerable engine code dates to PHP 5.4 from 2012. Because the problem is in PHP itself rather than WordPress, Drupal or Joomla application code, a site can remain exposed even when its CMS and extensions are otherwise clean. VirusTotal estimated that about 272,000 hosts run a supported PHP branch from 8.2 to 8.5. Sites on PHP 7.4, 8.0 or 8.1 should move to a supported branch or obtain a distribution-provided backport. Censys detected more than 3.08 million hosts and 56.6 million web properties using PHP, with more than 34.4 million PHP services assessed as vulnerable on October 23, 2026.