In a concerning development, operators of the Mirai botnet have begun attempting to exploit critical vulnerabilities in PHP2Shell, following the release of emergency patches by PHP on October 21. Despite these attempts, no confirmed breaches have been reported, according to multiple security firms monitoring the situation.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, allow for unauthenticated remote code execution and carry a CVSS v4.0 score of 9.2. Discovered by Wiz, OpenAI, and Calif in August, PHP expedited the patch release after the CVE identifiers were leaked online. The urgency of the situation prompted various organizations, including government and educational institutions in Europe, to take precautionary measures, resulting in several websites going offline.
Mirai Botnet Linked to Exploitation Attempts
Security firm Sophos reported that threat actors are leveraging PHP2Shell vulnerabilities to deploy a variant of the Mirai botnet, known as Potassium. Although Sophos successfully halted one such attempt, it noted that the malware was designed to download additional malicious payloads and execute distributed denial-of-service (DDoS) attacks. The firm also clarified that its earlier reports of successful exploitation were incorrect.
Further analysis by Arctic Wolf connected Potassium binaries to servers hosting PHP2Shell payloads, but it did not find evidence of successful exploitation. Hunt.io attributed the observed PHP2Shell traffic to a Mirai-style botnet that has been active since at least May 2026, which has recently incorporated these vulnerabilities into its attack methods.
Attempts, but No Confirmed Breaches
Other cybersecurity firms echoed Sophos’s findings, indicating that while exploitation attempts are ongoing, no confirmed compromises have occurred. Wordfence reported that attacks continue without any known successful breaches. Sansec, which had initially predicted rapid exploitation following the patch release, revised its assessment, stating that attackers require specific knowledge of server configurations to succeed, and that publicly available exploits often fail against default PHP installations.
Exploit Defeats ASLR in Production Setups
Researchers have identified address space layout randomization (ASLR) as a significant barrier to achieving code execution via these vulnerabilities. However, VulnCheck has developed an exploit that bypasses ASLR protections on x86-64 systems with PHP error display disabled, a common configuration for production environments. This exploit is currently available to VulnCheck’s Initial Access Intelligence customers.
Despite the emergence of numerous proof-of-concept (PoC) repositories on GitHub, VulnCheck noted that very few contain legitimate exploits. SOCRadar also reported finding PHP2Shell tooling on an attacker-controlled server, which included an exploit chain for PHP 8.4.26. However, the exploit’s requirements are uncommon, and SOCRadar found no evidence of successful access on any tested sites.
Patching Lags Behind
According to Qualys, only 199,000 PHP instances were patched within 12 hours of the vulnerabilities’ disclosure, highlighting a significant lag in patching efforts. Of approximately 110 million PHP instances, 71% are running outdated versions that will not receive vendor patches. As of October 23, the Cybersecurity and Infrastructure Security Agency (CISA) had not added either vulnerability to its Known Exploited Vulnerabilities catalog.
As organizations continue to grapple with the potential risks posed by these vulnerabilities, the lack of confirmed breaches suggests that while the threat is real, the exploitation of PHP2Shell may be more challenging than initially anticipated.
For further details on the ongoing situation, refer to the analysis by SecurityWeek.
