Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

What it is

PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two PHP engine bugs that allow unauthenticated remote code execution. Each scores 9.2 on CVSS v4.0. Wiz, OpenAI and Calif found them in August 2026. PHP released fixes on 21 October 2026, a day earlier than planned, after the CVE identifiers leaked online. Amazon saw the first exploitation attempt on 17 October.

Preconditions / Affected

Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Qualys data from 12,000 customers puts about 110 million instances (71%) on PHP 5.4 through 8.1. Those branches are end of life, and most will get no vendor patch. Another 44 million run supported branches but had not applied the fix. Only 199,000 instances were patched within 12 hours of disclosure.

Working exploitation depends on the target:

• Sansec (22 October update) says attackers need detailed knowledge of the server and particular conditions on it. Public exploits fail against PHP with default settings. Sansec had earlier predicted mass exploitation within 15 minutes of the patch.
• SOCRadar found an attacker's chain for PHP 8.4.26 on Apache mod_php that only works on servers configured more like test systems than hardened production ones.
• VulnCheck's exploit for CVE-2026-109618 beats ASLR through a memory leak. It works on x86-64 with ASLR on and PHP error display off, the recommended production setup, across multiple PHP versions. It is available only to VulnCheck's Initial Access Intelligence customers. VulnCheck says very few of the hundreds of GitHub PoC repositories contain real exploits.

What to do

Upgrade to one of the four fixed versions above. For branches 8.1 and older, the page names no fix, so those hosts need an upgrade to a supported branch. Censys runs a public dashboard of internet-facing PHP services still on vulnerable versions. The page says vendors and government agencies have published advisories and detection rules, but it gives none of them.

Caveats

Exploitation attempts are real, but no vendor has confirmed a compromise. Sophos, Hunt.io and Wordfence all say so, and Sophos believes attackers are struggling to build working exploits.

• Sophos attributes one attempt to Potassium, a Mirai variant with DDoS and malware-download functions. It was blocked before the malware arrived. This corrects an earlier Sophos update that reported a successful exploitation.
• Arctic Wolf linked two Potassium binaries to servers hosting PHP2Shell payloads. Its data does not show the PHP2Shell requests fetching or running the malware.
• Hunt.io ties the traffic to a Mirai-style botnet active since at least May 2026.
• The exposed attacker server screened about 20 sites (SOCRadar) and ran 10 rounds against 123 servers (Hunt.io). About 57 ran PHP, and none was exploited.
• CISA had not added either CVE to its KEV catalog as of the morning of 23 October 2026.
• Several European government, school and hospital sites went offline on 21 October as a precaution. The UK government reported 32 services unavailable and four partly unavailable.