Two days after PHP released emergency fixes for PHP2 Shell, threat actors tried to use the flaws to spread a Mirai-based botnet. Meanwhile, a security firm has built an exploit that gets past a key memory protection, and an exposed attacker server has revealed custom exploitation tooling.
Even so, no successful in-the-wild compromise has been confirmed so far.
PHP2 Shell is the name for two critical flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619. Both allow unauthenticated remote code execution and carry a CVSS v4.0 score of 9.2. Wiz, Open AI and Calif found them in August 2026.
PHP fixed them on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The release came one day earlier than planned, after the CVE identifiers leaked online.
The disclosure had immediate effects. On October 21, several government, school and hospital websites across Europe went dark. The UK government said 32 of its services were unavailable and four were partly unavailable, mostly as a precaution while patches were applied.
Attackers Attempt to Deploy Potassium, a Mirai-Based Botnet
Sophos says threat actors tried to use PHP2 Shell to install Potassium, which it believes is a variant of the Mirai botnet. The attempt Sophos analyzed was blocked, so the malware never reached its target.
Sophos describes the sample as an updated build, with more features, of a Mirai-derived strain first identified in early 2026. It can download more malware and launch distributed denial-of-service attacks.
The latest analysis corrects an earlier Sophos update that had reported a successful exploitation.
Arctic Wolf linked two Potassium binaries to servers hosting PHP2 Shell payloads. However, the company said its data does not show PHP2 Shell requests actually downloading or running the malware.
Hunt. io attributed the PHP2 Shell traffic it observed to an established Mirai-style botnet. That botnet has been active since at least May 2026 and recently added these flaws to its methods for spreading.
Sophos says the lack of successful exploits in the wild suggests attackers are struggling as well. Its adversary research team found that building a working exploit is difficult, even with help from AI.
Vuln Check Develops an ASLR Bypass
Researchers had pointed to address space layout randomization (ASLR), which randomizes where code and data sit in memory, as a major obstacle to turning PHP2 Shell into code execution.
Vuln Check says it has found a way around it.
The company's exploit for CVE-2026-109618 uses a memory leak to achieve code execution on x86-64 systems with ASLR enabled and PHP error display turned off. That is the configuration recommended for production servers.
The exploit is available only to customers of Vuln Check's Initial Access Intelligence service. Vuln Check says it does not know of any other public or commercial exploit that achieves remote code execution across multiple PHP versions in production configurations. It expects that to change.
The company also noted that hundreds of proof-of-concept repositories have appeared on Git Hub, and very few of them contain legitimate exploits.
Exposed Attacker Server Reveals Custom Tooling
SOCRadar found PHP2 Shell tooling on an attacker-controlled server whose working files could be browsed publicly.
The server held an exploit chain targeting PHP 8.4.26 on Apache mod_php. The operator had tested it in a lab and billed it as a " one-click " exploit. Companion scripts checked whether target websites had the required configuration.
According to SOCRadar, the chain only works on servers set up more like test systems than hardened production environments.
The operator fingerprinted about 20 websites in the United States, the United Kingdom, Canada, France, Finland, Poland and China, and probed 11 of them in depth. None met the requirements.
SOCRadar says the operator shows strong exploit development skills. As of October 22, however, it had seen no evidence of shell access on any of the sites the operator screened.
Hunt. io also analyzed the server. It identified 10 rounds of attacks, with the target list growing to 123 servers at cloud providers, shared hosting companies and internet service providers. About 57 of them ran PHP and 10 rejected the requests. None was successfully exploited.
Millions of Requests, Little Evidence of Success
No vendor has reported a confirmed compromise. Hunt. io says it has seen exploitation attempts and attackers preparing tooling, but no successful breach. Wordfence also reports that attacks continue without any known compromises.
Sansec had predicted mass exploitation within 15 minutes of the patch release. In an October 22 update, it revised that view. Attackers need detailed knowledge of a target server and specific conditions, and publicly available exploits fail against PHP installations running default settings.
As of the morning of October 23, CISA had not added either vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
The Patching Gap
Remediation is moving slowly.
Qualys analyzed anonymized data from 12,000 customers and found that only 199,000 PHP instances were patched within 12 hours of disclosure.
About 110 million instances, or 71%, run PHP 5.4 through 8.1. These branches are end of life, and most will never get a vendor patch. Another 44 million run supported branches that have fixes available but not yet applied.
Censys has launched a public dashboard that tracks PHP2 Shell patching progress.
The central lesson from the latest PHP2 Shell developments is that the absence of confirmed breaches should not be mistaken for safety. Exploit development is moving quickly, an ASLR bypass already exists, and tens of millions of servers remain unpatched, so the window for organizations to act is closing.