Mirai-derived Potassium botnet linked to PHP2Shell exploitation attempts

PHP patched two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026, releasing fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 one day earlier than planned after CVE identifiers leaked. The flaws, named PHP2Shell, affect the PHP engine and can be exploited through specially crafted HTTP requests to run code with the privileges of the web server account. Sophos linked exploitation attempts to Potassium, a Mirai-derived botnet variant first identified in early 2026.

VulnCheck developed an exploit for CVE-2026-109618 that bypasses Address Space Layout Randomization, a security mechanism that randomizes memory locations to make exploits harder to execute, on x86-64 systems with PHP error display turned off. The technique achieves remote code execution in production configurations and is available to VulnCheck’s Initial Access Intelligence customers. The exploit uses a memory leak to overcome the memory protection on hardened production setups.

Researchers at Wiz, OpenAI, and Calif discovered the PHP2Shell vulnerabilities in August 2026, months before patches were released. Amazon detected the first exploitation attempt targeting the flaws on October 17, 2026, and attack activity surged after the public disclosure.

Qualys found that only 199,000 PHP instances were patched within 12 hours of the vulnerability disclosure, leaving roughly 110 million instances, or 71%, running end-of-life versions 5.4 through 8.1 that will never receive patches. Censys tracks patching progress in real time and counted over 34.4 million internet-facing PHP services still vulnerable as of October 23, 2026.

Government, school, and hospital websites in Europe went offline on October 21, 2026, as a precautionary measure while patches were applied. The shutdowns included 32 UK government services and were part of broader precautionary steps to mitigate risk.

Sophos and Arctic Wolf analyzed Potassium samples and confirmed the variant’s connection to PHP2Shell exploitation attempts, but no successful compromise has been confirmed. Sophos initially reported a successful exploitation before correcting its assessment, and the firm said threat actors are struggling to develop reliable exploits even with AI assistance. Sophos and other firms also warned that successful exploitation may depend on specific PHP versions, deployment architecture and server configurations, making claims of working exploits unreliable in real-world scenarios.

Hunt.io attributed PHP2Shell traffic to an established Mirai-style botnet active since at least May 2026 that added the flaws to its exploitation methods. The firm analyzed an attacker server and found 10 attack rounds targeting 123 servers, 57 of which ran PHP, though none were successfully exploited. SOCRadar uncovered PHP2Shell tooling on an exposed attacker-controlled server on October 22, 2026, including an exploit chain for PHP 8.4.26 on Apache mod_php, but found no evidence of successful shell access on screened sites because the tooling required configurations uncommon in production.

The attacker server also contained scripts to fingerprint websites for PHP version, server setup and session settings required for exploitation, checking about 20 websites across multiple countries without finding any that met the prerequisites. Multiple security firms, including Wordfence, Beelzebub and Dataminr, reported observing exploitation attempts but confirmed no successful compromises, with activity limited to scanning, fingerprinting and failed attempts.

Potassium resolves a hard-coded, encrypted command-and-control address, 134.199.154[.]64, and establishes a TCP connection to retrieve a Linux ELF binary payload, an executable file format, after checking for an HTTP 200 response and ELF magic bytes. The variant supports 24 commands for flood attacks over ICMP, TCP, UDP and OpenVPN protocols and includes configuration for resolving infrastructure through Ethereum Name Service, though ENS resolution was disabled in analyzed samples. Sophos said, “The sample displays downloader and network disruption functionality.”

Security Arsenal provided detection rules and remediation guidance focused on post-exploitation behavior such as PHP processes spawning shells or download utilities, including Sigma rules, KQL queries and Velociraptor VQL hunts for Mirai Potassium artifacts. The firm recommended disabling dangerous PHP functions such as exec and shell_exec and restricting outbound egress from web servers to prevent the download-cradle stage of the attack chain while patching proceeds.

CISA had not added either PHP2Shell vulnerability to its Known Exploited Vulnerabilities catalog as of October 23, 2026. Cloudflare observed tens of thousands of exploitation attempts within 45 minutes of the public announcement, with activity reaching millions by October 22, 2026, and the UK National Cyber Security Centre issued approximately 50,000 warnings to businesses and organizations.

The vulnerabilities date back to PHP 5.4, released in 2012, and affect the PHP engine itself rather than only applications such as WordPress or Drupal. The Mirai botnet first emerged in 2016 and has since spawned numerous variants targeting IoT devices, routers and other systems for distributed denial-of-service attacks and cryptojacking.