FHN 
Two critical vulnerabilities in PHP have drawn attention after public exploit code became available and attackers attempted to use the flaws to deliver botnet malware.
Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities have CVSS scores of 9.2 out of 10. Under vulnerable conditions, they could allow attackers to execute code on a server without authentication.
The attacks are associated with a threat known as PHP2Shell. However, attempted exploitation does not automatically mean a server has been compromised.
Sophos clarified in an update published on October 22 that its customer telemetry showed scanning and a small number of unsuccessful exploitation attempts. The company reported no evidence of successful compromise through these vulnerabilities in the observed activity.
What Makes the PHP2Shell Flaws Dangerous?
The two vulnerabilities involve problems with how PHP manages memory and processes request data.
CVE-2026-109618 involves memory corruption during request cleanup following an out-of-memory condition. CVE-2026-109619 concerns older request data remaining in shared internal state, where it may be reused by a later request handled by the same worker.
Under the right conditions, these weaknesses could give attackers a way to execute malicious code without first obtaining valid login credentials.
The risks extend beyond websites running PHP directly. Software products, network appliances, management interfaces, and other applications that include PHP may also require updates from their vendors.
PHP released security fixes on October 21, 2026. Administrators should check which PHP runtime each application actually uses, rather than relying only on the version reported by a command-line installation.
Researchers Find a Mirai-Based Botnet Payload
Security researchers examining the attempted attacks identified a payload associated with Potassium, a likely variant of the Mirai botnet family.
The malware is designed to download additional executable code and can support network disruption attacks. Mirai-derived botnets commonly recruit compromised devices and use them to launch distributed denial-of-service (DDoS) attacks against targeted services.
Analysis of the Potassium sample revealed several behaviors:
- Command-and-control communication: The malware attempts to contact infrastructure used to receive instructions.
- Executable downloads: It checks the server response and looks for Linux executable file signatures before proceeding.
- Alternative name resolution: It can use public DNS services as a fallback when resolving hostnames.
- Network attack capabilities: Its Mirai-related functionality can be used to generate traffic against targeted systems.
The presence of a downloader or a suspicious network request does not, by itself, confirm that malware executed on a victim’s server. Sophos reported that security controls blocked the observed attempts before the payload was delivered.
How Organizations Should Respond
Organizations running PHP should treat these vulnerabilities as a priority, particularly when their servers are accessible from the internet.
Recommended actions include:
- Install security updates: Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, as appropriate, or apply an approved vendor-provided security fix.
- Check every deployment: Review PHP installations in containers, bundled applications, appliances, and hosting environments.
- Restart affected services: Confirm that PHP-FPM workers and other relevant processes are running the patched code.
- Review security logs: Look for suspicious HTTP requests, unexpected child processes, and unusual outbound network connections.
- Strengthen temporary protections: If immediate patching is not possible, consider restricting public access or placing exposed systems behind network-level authentication.
- Update detection rules: Keep endpoint protection, intrusion prevention, and web application firewall rules current.
Security teams should also review earlier logs for signs of probing or attempted exploitation. A blocked request should not be treated as proof of a successful attack, but neither should it be ignored without checking the surrounding activity.
Conclusion
PHP2Shell highlights the risks that arise when critical server-side vulnerabilities become publicly exploitable. Although the reported attempts did not result in confirmed compromises in Sophos’ observed customer activity, vulnerable PHP installations may still face exposure.
Applying the appropriate patches, checking bundled runtimes, and monitoring for suspicious behavior are essential steps to reduce the risk of remote code execution and potential botnet infection.
IoCs
| Type | Indicator | Source context |
|---|---|---|
| Source IP | 45[.]198[.]224[.]169 | PHP2Shell exploit attempt |
| Payload-hosting IP | 92[.]118[.]112[.]100 | Related payload infrastructure |
| Payload URL | hxxp://92[.]118[.]112[.]100/nfs | Related malware download location |
| Command-and-control IP | 134[.]199[.]154[.]64 | Potassium C2 server |
| Command-and-control IP | 117[.]55[.]202[.]115 | Potassium C2 server |
| Domain | thunder[.]godofthunder[.]st | Contacted during sandbox analysis |
| Domain | hackattackkaboom[.]botlesscucks[.]st | Related malware staging server |
| Domain | hik[.]gettingheadfromduckysmom[.]st | Potassium infrastructure embedded in payload |
| MD5 | b61a098fc62a2c2696e196dca78da71a | Related likely Mirai-variant sample |
| SHA-1 | c472dab4ff7c16782a8037f988d4daa6d4bdb343 | Related likely Mirai-variant sample |
| SHA-256 | 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 | Related likely Mirai-variant sample |
| File path | /tmp/nfs | Published payload-path indicator |
| Command | ./nfs php | Published payload-execution indicator |
| User-Agent | php2shell-scan/109618 | Observed exploit traffic |
| Multipart boundary | B7kQpoc618 | Observed exploit-request string |
About the Author
