The cybersecurity landscape has witnessed a new threat as attackers attempt to exploit recent PHP vulnerabilities, known as PHP2Shell, to propagate the Mirai botnet. Following emergency fixes released by PHP, threat actors have been observed trying to leverage these vulnerabilities. Despite these attempts, there have been no confirmed cases of successful exploitation in the wild.
PHP2Shell Vulnerabilities and Initial Exploitation Attempts
PHP2Shell refers to two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, identified in the PHP engine. These vulnerabilities allow unauthenticated remote code execution and have high severity scores. Discovered by Wiz, OpenAI, and Calif in August, PHP released patches on October 21. The vulnerabilities were leaked online, prompting a surge in exploitation attempts, particularly after the patches were made available.
Amazon reported the first exploitation attempt on October 17, which increased once the patches were released. As a precaution, several organizations, including government and educational institutions, temporarily took their systems offline. Security advisories and patching guidance followed from various vendors and agencies.
Mirai Botnet and PHP2Shell Exploitation
Security firm Sophos identified attempts to use PHP2Shell vulnerabilities to deploy a Mirai botnet variant named Potassium. Although these efforts were thwarted, the malware, believed to have evolved with additional functionalities, poses a serious threat. Sophos noted that the malware can facilitate distributed denial-of-service (DDoS) attacks and download other malicious payloads.
Hunt.io observed traffic indicative of Mirai-style botnet activity, suggesting the incorporation of PHP2Shell vulnerabilities into its arsenal. However, no successful breaches have been confirmed, with attackers reportedly struggling to exploit the vulnerabilities effectively.
Challenges in Exploiting PHP2Shell and ASLR Bypass
Several firms, including Wordfence and Sansec, have reported ongoing attack attempts but no confirmed compromises. The difficulty in exploiting PHP2Shell is partly due to address space layout randomization (ASLR), a security feature that hinders code execution. VulnCheck has developed an exploit that bypasses ASLR on certain systems, although it remains unavailable to the public.
SOCRadar discovered an attacker’s server containing tools targeting PHP2Shell, but these require uncommon server configurations to succeed. Their attempts to exploit several websites have so far yielded no results.
Ongoing Threat and Mitigation Efforts
Despite the absence of documented successful exploits, the cybersecurity community remains vigilant. Qualys reported that patching progress is slow, with a significant number of PHP instances remaining vulnerable. Censys is monitoring the situation in real-time, providing insights into the patching status across internet-facing PHP services.
As the industry works to address these vulnerabilities, it is crucial for organizations to apply patches promptly and ensure their systems are configured securely to resist potential exploitation.
