"The vulnerable code dates back to PHP 5.4, released in 2012," the Sysdig Threat Research Team said.
What the PHP2Shell flaws are and where to patch
Security teams are racing to remediate two high-severity vulnerabilities — CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) — that permit unauthenticated remote code execution via specially crafted HTTP requests. The PHP project issued fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The bugs reside in the PHP engine rather than in application code, meaning even clean WordPress, Drupal or Joomla installs running vulnerable PHP builds may be exposed.
Mirai-derived "Potassium" payloads and observed infrastructure
Researchers at Sophos and Arctic Wolf reported that attempted PHP2Shell exploitation has been tied to a Mirai-derived botnet variant named Potassium. Sophos said the sample resolves a hard-coded, encrypted command-and-control (C2) address, connects to 134.199.154[.]64 over TCP and sends an HTTP request, then checks for an HTTP 200 and that the resulting payload begins with ELF magic bytes (7F 45 4C 46), indicating an expected Linux ELF follow-on binary. Sophos added the sample displays downloader and network disruption functionality and can execute DDoS attacks.
Analysis mapped multiple malicious indicators and connections:
- Observed attack source IPs: 85.11.167[.]243, 217.60.242[.]76, and 45.198.224[.]169.
- An intermediate retrieval host used to fetch a loader: 92.118.112[.]100.
- Potassium resolves thunder.godofthunder[.]st to 134.199.154[.]64 and establishes a C2 channel on TCP port 50792.
- The botnet issues a DNS query for thunder.godofthunder[.]st and contains fallback logic using public DNS servers such as 8.8.8.8, 1.1.1.1 and 1.0.0.1.
Arctic Wolf said the botnet supports 24 commands for flood attacks over ICMP, TCP, UDP and OpenVPN, includes builds for ARM and x86, and embeds configuration for Ethereum Name Service (ENS) resolution — a capability that was disabled in both samples they reviewed.
According to Sophos, the observed end goal for some of the activity is sustained volumetric flood attacks targeting two adjacent hosts in a Ukrainian network: 45.88.138[.]0 and 45.88.138[.]44.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTooling, scanning scale, and the ASLR problem
Multiple intelligence providers described a sprawling exploitation effort and a mixed technical picture. Cloudflare reported tens of thousands of exploit attempts within 45 minutes of disclosure, rising to hundreds of thousands within two hours and to millions by early October 22, 2026. Cisco Talos said most activity so far is scanning and uncoordinated attempts to deliver payloads.
SOCRadar discovered an attacker-controlled server (206.188.197[.]105:9999) hosting a PHP2Shell "one-click" exploit labeled aslr_exploit.py for PHP 8.4.26 under Apache mod_php, plus three companion screening scripts (php2shell_fp.py, deep_probe.py and wp_attack.py) that check roughly 20 public sites for the exact preconditions the exploit chain requires. SOCRadar said no screened site had evidence of shell access as of October 22, 2026.
VulnCheck's Spencer McIntyre told The Hacker News his team developed a novel technique that chains the two vulnerabilities together to leak memory and bypass Address Space Layout Randomization (ASLR), achieving remote code execution on x86-64 systems even with PHP's production error-display setting. VulnCheck warned that a foothold in a vulnerable web application can expose API keys, database connections and other internal services reachable by the application.
Who has seen activity — and where exploitation has not succeeded
Telemetry from multiple vendors paints a common theme: broad probing but few confirmed successful takeovers. Previdian reported hundreds of attempts against CVE-2026-109618 and fewer for CVE-2026-109619, with the first recorded exploit probe on October 21, 2026 at 13:05 UTC, yet no observed remote code execution or dropped PHP files in their honeypots. Beelzebub, Dataminr and Wordfence similarly described activity limited to scanning, fingerprinting, credential and secret theft attempts, and second-stage retrievals. Wordfence listed additional probing IPs, including 87.121.84[.]174, 181.215.186[.]252 and 185.196.220[.]132 among others.
Hunt.io said the attacker behind the 206.188.197[.]105 server targeted 123 servers across cloud, shared-hosting and ISP networks — about 57 of them running PHP, many on unsupported 5.x–7.x branches — but reported none exploited. The lack of widespread successful exploitation led Sophos to assess that actors are "struggling" to devise reliable exploits.
What this means for security teams, public-sector operators, and Web3-focused targets
- Security teams and technologists: Patch supported PHP branches to 8.2.35/8.3.36/8.4.27/8.5.12 where possible, prioritize hosts reachable by web applications, and monitor for the specific IPs, DNS names and C2 behaviors reported by Sophos and Arctic Wolf.
- Government, school and hospital operators: Several public websites took precautionary outages across Asia, Europe and North America; the U.K. government confirmed 32 digital services unavailable and four partially unavailable while mitigations were applied, and the NCSC issued roughly 50,000 warnings.
- Web3 and crypto-focused operators: SOCRadar linked the toolset to financially motivated actors harvesting API keys and backend URLs from client-side JavaScript; Arctic Wolf noted ENS resolution logic embedded in samples, which — if enabled — could complicate disruption.
The technical record is clear: defenders can point to millions of probes and tens of millions of potentially vulnerable properties but only limited evidence of successful, large-scale PHP2Shell takeovers as of October 23, 2026. Censys estimates over 3.08 million hosts and 56.6 million web properties run PHP, and more than 34.4 million PHP services remain assessed as vulnerable — a footprint that, Sysdig warned, could produce a long tail of risk similar to Log4Shell. Whether weaponized payloads such as Potassium will evolve faster than defenders can patch remains the central immediate question.
