Recent attempts by cybercriminals to exploit PHP2Shell vulnerabilities have been observed, aiming to integrate compromised systems into the Mirai botnet variant known as Potassium. Despite the surge in exploit attempts, successfully weaponizing these vulnerabilities has proven more challenging than anticipated.
Uncovering the PHP2Shell Vulnerabilities
The targeted vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both have CVSS scores of 9.2, indicating their critical nature. These flaws could allow unauthenticated remote code execution through crafted HTTP requests. PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have already addressed these security issues.
Sophos has analyzed a sample of the Potassium botnet, revealing it as an advanced version of the Mirai-derived malware. The botnet establishes a command-and-control connection, verifying payloads using specific Linux ELF binary indicators, and supports IPv4 and DNS resolution.
Botnet Activities and Attack Patterns
The botnet has been traced to specific IP addresses, attempting to deploy a loader to execute the Mirai variant. These activities are coordinated to launch DDoS attacks against specific Ukrainian network hosts. Despite these efforts, no successful exploits using PHP2Shell have been confirmed in the wild.
Potassium’s initial detection was reported by Synthient in early 2026. This variant utilizes novel encryption methods like ChaCha20 and a reverse-shell protocol, further complicating cybersecurity defenses.
Challenges in PHP2Shell Exploitation
Researchers at SOCRadar discovered PHP2Shell exploit tools on an exposed server, with scripts designed to identify vulnerable PHP setups across global websites. Despite these tools’ availability, successful exploitation remains elusive, as many sites do not meet the necessary conditions for the exploit to succeed.
Address Space Layout Randomization (ASLR) presents a significant hurdle for attackers. However, VulnCheck developers have demonstrated a possible bypass using memory leaks, although this method is complex and not widely replicated.
Cloudflare and other cybersecurity firms report large-scale scanning and exploit attempts, yet no confirmed remote code execution has been achieved. The vulnerabilities have led to precautionary shutdowns of numerous digital services to mitigate potential risks.
Long-term Implications and Security Recommendations
The PHP2Shell vulnerabilities, affecting code dating back to PHP 5.4, pose long-term risks similar to those seen with Log4Shell. Many PHP services remain vulnerable, urging organizations to update to supported PHP versions or apply distribution backports.
With millions of web properties potentially exposed, the cybersecurity community continues to monitor and defend against these evolving threats, emphasizing the importance of timely updates and comprehensive security measures.
