FHN 
Publicly available exploit tools are making it easier for attackers to target websites running vulnerable versions of PHP. Universities and businesses are among the organizations at risk, as compromised web servers could be used to run malicious commands.
The attacks involve two critical PHP engine flaws, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both have a reported CVSS v4.0 score of 9.2 and could allow remote command execution without requiring an attacker to log in.
Although PHP published fixes on October 21, 2026, exploit scripts appeared online soon afterward. This creates a serious challenge for organizations that have not yet updated their systems.
How the PHP2Shell Vulnerabilities Work
The flaws affect PHP’s internal processing rather than a specific website’s application code. As a result, even a well-written website may remain at risk if its underlying PHP environment is vulnerable.
The PHP project identifies Apache configurations that run PHP through the mod_php module as particularly concerning, because exploitation may occur before the website’s own code executes.
Researchers from Akatsuki Legion reported finding attackers using publicly available exploit code. Their analysis linked the exploit chain to a researcher known as 9bie and described proof-of-concept scripts appearing on GitHub after the fixes were released.
The two vulnerabilities work together in the reported exploit chain:
- CVE-2026-109618: A memory-handling flaw associated with upload processing can expose information about the process’s memory.
- CVE-2026-109619: A separate issue involving reused request data can allow information from an earlier request to affect a later one.
The published scripts reportedly combine memory leaks with manipulated data structures to redirect PHP execution and run attacker-selected commands.
Researchers also observed signs of activity around the time of disclosure. Amazon Threat Intelligence reported exploit probing on October 17, before the public release of the patches. Hunt.io later identified three different exploit toolkits in its October 21 telemetry.
What Website Administrators Should Do
The PHP project has released corrected versions for supported branches. Administrators should upgrade to the appropriate version:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Systems running PHP 8.1 or older require special attention because those branches no longer receive standard updates from the PHP project. Administrators should use a trusted vendor-provided security fix or migrate to a supported release.
Researchers have also reported a possible connection between PHP2Shell activity and Linux botnet operations. Sophos examined a blocked payload resembling a Mirai variant, but found no confirmed evidence that the observed attempt successfully compromised a system.
Security teams should take the following steps:
- Update every PHP installation to a fixed release or a trusted vendor-patched version.
- Restart affected services after patching so that the updated code is loaded.
- Check all deployment types, including Apache modules, PHP-FPM services, containers, and bundled appliances.
- Review web logs for suspicious POST requests involving
PHP_SESSION_UPLOAD_PROGRESS. - Investigate unusual server activity, including unexpected processes, outbound connections, and possible botnet behavior.
Disabling session.upload_progress.enabled and restarting workers may reduce exposure in some environments, but this is only a temporary measure and does not replace installing the appropriate fix.
For universities and businesses, the main concern is that public exploit code reduces the effort needed to attack vulnerable servers. Prompt patching, complete asset inventories, and careful log review can help reduce the risk of website compromise.
IoCs
| Type | Indicator | Context from source |
|---|---|---|
| IPv4 | 206[.]188[.]197[.]105 | Mirai variant C2 and mass target list host; also hosts php2shell_mass.py and junare_exploit.py |
| IPv4 | 41[.]223[.]30[.]7 | Serves history.json tied to exploitation attempts |
| IPv4 | 122[.]10[.]130[.]72 | Hosts exp_83.php, a PHP serialization payload |
| IPv4 | 195[.]245[.]112[.]63 | Outdated PHP service on port 8082, flagged High Risk for Keitaro malware |
| IPv4 | 85[.]11[.]167[.]243 | Open directory showing exploit requests (body text lists 85[.]11[.]163[.]243) |
| IPv4 | 124[.]221[.]46[.]164 | Open directory hosting i097_listener.py and i097_listener80.py on ports 80 and 8888 |
| Domain | thunder[.]godofthunder[.]st | Linked to the Potassium Mirai variant targeting Ukrainian networks |
| User-Agent | php2shell-109618 | Seen in an exploit request |
| URI path | /lib/phpunit/phpunit/Util/PHP/eval-stdin.php | Path in an observed exploit POST request |
| Form field | PHP_SESSION_UPLOAD_PROGRESS | Multipart trigger field for the upload-progress flaw |
| Command | id>/out/p1 | Example command in the exploit’s execution stage |
| Proof file | /out/p1, /tmp/p1 | Files checked to confirm exploit success |
| Script | r935_lfi_find.py | LFI discovery scanner |
| Script | probe_rfc1867.py | Tests whether upload_progress is enabled |
| Script | race.py | Race harness for the upload parsing window |
| Script | php2shell_fp.py | Fingerprints PHP targets through a proxy pool |
| Script | rce2.py | Session file poisoning through a Kubio LFI |
| Hash | Not published | The source lists no MD5, SHA-1 or SHA-256 values |
About the Author
