Following the public release of proof-of-concept code for two significant PHP vulnerabilities, attackers have begun attempts to exploit these flaws to deploy botnet malware. Known collectively as PHP2Shell, the vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619 pose a severe threat with a CVSS score of 9.2, potentially allowing unauthorized code execution.
Understanding the PHP2Shell Exploits
The PHP2Shell vulnerabilities enable attackers to execute code without authentication, but evidence of successful breaches is lacking. Sophos reported recent scanning activities and a few failed exploitation attempts as of their latest update on October 22. These attempts have not resulted in successful system compromises.
Research by Sophos pinpointed the intended malicious payload as Potassium, a probable variant of the Mirai botnet. Although the payload delivery was blocked, analysis indicated an evolved version of the malware, capable of network disruption and download operations.
History and Technical Aspects of PHP2Shell
The discovery of these vulnerabilities traces back to PHP attacks predating the public release of patches, with Amazon documenting activity as early as October 17. This timeline underscores the importance for security teams to review historical logs to differentiate between attempted and actual attacks.
The vulnerabilities affect PHP when used with various configurations, including PHP-FPM, Apache mod_php, and others. The Dutch National Cyber Security Centre has identified Apache mod_php as particularly susceptible due to its ability to be exploited before application code execution.
Mitigation and Future Outlook
To safeguard against these vulnerabilities, PHP has issued updates, and users are advised to upgrade to secure versions like PHP 8.5.12. Additionally, the management of bundled PHP applications and appliances requires careful attention to ensure comprehensive protection.
Sophos has incorporated intrusion prevention signatures and recommends ongoing monitoring of network activity and unusual processes. Temporary measures, such as enhanced firewall rules, can mitigate risk but do not substitute for immediate patching.
Organizations are encouraged to remove exposed PHP systems from direct internet access or apply network-level authentication to mitigate potential threats. Continuous vigilance and timely updates are critical in defending against this evolving threat landscape.
