Mirai Operators Join PHP2Shell Attacks, No Breach Confirmed
Three days after PHP shipped emergency fixes, security firms report exploitation attempts, a botnet adding the flaws to its spreading kit and an exploit that defeats a core memory protection. None of them has confirmed a successful compromise.
No security vendor has confirmed a successful compromise through PHP2Shell, the pair of critical flaws in the PHP engine, three days after the project shipped emergency fixes on 21 October 2026. That is not for want of trying. Sophos says it has seen attempts to use the bugs to install Potassium, which it believes is a variant of the Mirai botnet, and Hunt.io has traced the PHP2Shell traffic it observed to an established Mirai-style botnet active since at least May 2026 that recently added the flaws to its spreading kit.
The two flaws, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS v4.0 score of 9.2 and let an unauthenticated attacker run code on a web server. Wiz, OpenAI and Calif found them in August 2026, according to SecurityWeek. PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October, a day earlier than planned, after the CVE identifiers leaked online. Amazon recorded the first exploitation attempt on its honeypots on 17 October, four days before a fix existed.
What the sensors actually show
Sophos says the attempt it analysed was stopped before the malware reached the targeted system, and that its latest analysis corrects an earlier company update which had reported a successful exploitation. Arctic Wolf connected two Potassium binaries to servers hosting PHP2Shell payloads but said its data does not show the PHP2Shell requests fetching or running the malware. Wordfence says attacks continue without any known compromises.
The lack of successful exploits in the wild suggests threat actors are also struggling.
Sansec, which had predicted mass exploitation within fifteen minutes of the patch release, revised that view on 22 October. It said attackers need detailed knowledge of a server and particular conditions on it, and that public exploits fail against PHP installations running default settings.
An exploit that gets past ASLR
Address space layout randomisation, which scatters where code and data sit in memory, has been the main obstacle to code execution. VulnCheck says it has found a way around it. Its exploit for CVE-2026-109618 uses a memory leak to reach code execution on x86-64 systems with ASLR enabled and PHP error display turned off, the recommended production setup. It has gone to the firm's Initial Access Intelligence customers rather than being published.
We are not aware of any other public or commercial exploit that achieves RCE on multiple versions of PHP in production configurations, though we expect that to change as adversaries develop incrementally more sophisticated attacks.
SOCRadar found an attacker-controlled server whose working files had been left publicly browsable. They included an exploit chain for PHP 8.4.26 on Apache mod_php that the operator had tested in a lab and billed as a one-click exploit, plus scripts checking whether real sites had the narrow configuration it requires. The operator fingerprinted about 20 websites and probed 11 more closely; none met the requirements. Hunt.io, analysing the same server, counted ten attack rounds against 123 servers, with none exploited.
The 110 million that will never get a patch
Qualys analysed anonymised data from 12,000 of its customers and found that only 199,000 PHP instances were patched within twelve hours of disclosure. Roughly 110 million instances, or 71 per cent, run PHP versions 5.4 through 8.1, which are past end of life, and most will never receive a vendor patch. Another 44 million run supported branches where fixes exist but had not been applied.
The disruption has been real even without a confirmed breach. Several government, school and hospital websites in Europe went dark on 21 October, and the UK government said 32 of its services were unavailable and four partly unavailable, mostly because of precautions taken while patches were applied. As of the morning of 23 October, CISA had not added either vulnerability to its Known Exploited Vulnerabilities catalogue, which sets remediation deadlines for US federal civilian agencies.
The honest reading is that difficulty, not defence, has held the line so far. Sophos says its own adversary research team found a working exploit hard to build even with help from AI, and VulnCheck expects exploit quality to improve as attackers iterate. What nobody can say is whether a quiet compromise has already happened on a server whose owner has not gone looking. As Parallax Nexus reported this month, the Ivanti and BeyondTrust intrusions ran for weeks before anyone noticed.
What happens next?
- Watch whether CISA adds either CVE to its Known Exploited Vulnerabilities catalogue, which would set a federal remediation deadline.
- Exploit reliability is likely to improve now that VulnCheck has shown ASLR can be bypassed in a production configuration.
- Censys is publishing a live dashboard of how many internet-facing PHP services still run a vulnerable version.
Related topics
Sources & references
- 01Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge — SecurityWeeknewsPublished 23 October 2026; primary account of the vendor findings cited here.
- 02Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security AgencyprimaryChecked for CVE-2026-109618 and CVE-2026-109619 as of 23 October 2026.
- 03PHP2Shell vulnerabilities — VulnCheckreportASLR bypass exploit for CVE-2026-109618.
- 04Proof of concept exploit released for PHP vulnerabilities 109618 and 109619 — SophosreportPotassium botnet attempts and the correction to an earlier update.
- 05PHP announces critical security release for two vulnerabilities — QualysreportPatching telemetry from 12,000 customers, published 20 October 2026.
- 06PHP2Shell research — Sansecreport22 October 2026 update revising the mass exploitation forecast.
- 07PHP2Shell exploit tooling on an attacker server — SOCRadarreportExposed attacker server and target fingerprinting, as of 22 October 2026.
More from Security
Stolen GitHub Tokens Put Malware in a LiteLLM Release
A compromised release pipeline put a poisoned LiteLLM build on PyPI and Docker for under three hours on 21 October 2026. It harvested cloud secrets, AI provider API keys and SSH keys, and Wiz says the attackers were spending stolen AWS credentials about four and a half hours later.
Attackers Are Escalating to Root Through a Japanese Web Firewall
A command injection flaw in the SiteGuard Server Edition web application firewall, CVE-2026-106931, is being exploited to run commands as root or SYSTEM. JPCERT/CC alerted users on 14 October 2026 and the vendor told support customers on 29 September.
China-Linked Scanner Holds 1,300 Exploit Scripts, FBI Says
A joint advisory led by the FBI describes MicroScan, a Python web application holding more than 1,300 penetration-testing scripts that China-linked actors have used since at least 2017. CISA added five of the eight named flaws to its exploited-vulnerability catalogue with a federal deadline that expired on 11 October.
FBI Removes Contractor Over an Unapplied PeopleSoft Patch
The FBI says the breach of its job applicant portal followed a third party's failure to install a security patch, and has removed the contractor responsible. Reuters, citing two unnamed sources, identified the contractor as working for Accenture and the platform as Oracle PeopleSoft.