PHP2Shell Exploit Attempts Reach Millions as Hackers Target Servers With Mirai Botnet Malware
Cybercriminals are launching millions of exploitation attempts against recently disclosed PHP vulnerabilities, with researchers identifying campaigns designed to install a Mirai-based botnet on compromised servers. Despite the surge in malicious traffic, security companies report that many attempts have failed, suggesting that turning the critical PHP2Shell flaws into reliable remote code execution exploits is more technically challenging than initially anticipated.
The attacks target CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities affecting PHP's internal memory management. Both carry a CVSS severity score of 9.2 and can potentially enable unauthenticated remote code execution through specially crafted HTTP requests.
Emergency fixes were released on October 21, 2026, in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, a substantial number of websites continue to operate outdated PHP installations, creating a large pool of potentially exposed infrastructure.
Cloudflare reported that exploitation attempts increased from tens of thousands shortly after the vulnerabilities were disclosed to millions by early October 22. Meanwhile, researchers from Sophos, Arctic Wolf, SOCRadar, and other cybersecurity companies identified multiple campaigns involving automated scanning, exploit development, and attempted malware deployment.
The findings illustrate an important distinction in vulnerability management: widespread exploitation attempts do not necessarily indicate widespread successful compromises. Nevertheless, the combination of critical runtime vulnerabilities, extensive internet exposure, and increasingly sophisticated exploit development presents a serious challenge for organizations operating PHP-based applications.
Attackers Attempt to Deploy Potassium, a Mirai-Based Botnet
One of the most significant developments involves an attempted malware campaign designed to deploy Potassium, a variant of the notorious Mirai botnet.
Mirai originally became widely known for compromising internet-connected devices and using them to launch large-scale distributed denial-of-service attacks. Since its source code became publicly available, numerous variants have emerged, incorporating new capabilities and targeting different types of systems.
Sophos researchers identified attempts to exploit PHP2Shell as a delivery mechanism for Potassium. The malware includes functionality for retrieving additional payloads, communicating with attacker-controlled infrastructure, and executing network disruption attacks.
Analysis revealed that the malicious loader contacts remote infrastructure to download an executable payload. It checks whether the server responds successfully and verifies that the downloaded file begins with the expected Linux ELF executable signature before continuing.
The researchers also identified a command-and-control infrastructure associated with the campaign, including a server at134.199.154[.]64. The malware uses DNS resolution techniques and fallback public DNS services to maintain connectivity.
Further investigation connected the campaign to infrastructure intended to launch sustained volumetric attacks against two hosts within a Ukrainian network. This suggests that the operators were attempting to expand their botnet capacity for disruptive activity rather than simply collecting information from vulnerable websites.
Arctic Wolf independently examined Potassium samples and identified support for 24 commands associated with flooding attacks over protocols including TCP, UDP, ICMP, and OpenVPN.
The malware also contained dormant functionality for resolving command-and-control infrastructure through Ethereum Name Service. Although this capability was disabled in the analyzed samples, its presence indicates that the developers were exploring alternative communication methods that could make future variants more difficult to disrupt.
However, the observed PHP2Shell delivery attempts were unsuccessful in the environments examined by researchers. The presence of a malware payload does not establish that attackers successfully executed it on vulnerable servers.
Millions of Requests, but Limited Evidence of Successful Exploitation
The scale of malicious activity increased rapidly after PHP maintainers publicly disclosed the vulnerabilities.
According to Cloudflare, attackers began probing PHP2Shell approximately 45 minutes after the announcement. The volume increased to hundreds of thousands of requests within two hours and reached millions by the following morning.
Other cybersecurity companies observed similar behavior across honeypots and monitored infrastructure. Cisco Talos reported widespread scanning and attempts to deliver different payloads, while Previdian identified hundreds of exploitation attempts originating from dozens of IP addresses.
Yet the effectiveness of these attacks appears considerably lower than the volume might suggest.
Previdian reported no successful remote code execution or dropped PHP files in the activity it observed. Researchers from Dataminr, Beelzebub, and Wordfence similarly described campaigns dominated by fingerprinting, scanning, and attempts to