Exploit / PoChigh
PHP2Shell exploit attempts try to deploy Potassium Mirai
Original title: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
AI summary · x-ai/grok-4.7Summaries by Vani AI
Sophos says the attempts failed, while SOCRadar found exploit tooling aimed at PHP 8.4.26.
Threat actors are attempting to exploit PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 for unauthenticated remote code execution and to deploy Potassium, a Mirai-derived botnet. Sophos says the observed attempts were unsuccessful and that reliable exploitation appears harder than expected. SOCRadar found exploit tooling for PHP 8.4.26 and screening scripts, but reported no shell access on screened sites as of October 22, 2026.
Unconfirmed: Sophos says no successful PHP2Shell attack was observed and actors appear to be struggling; SOCRadar reported no shell access on screened sites.
Key facts
- Fixed PHP versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- Potassium uses C2 134.199.154.64 and can launch flood attacks.
- Observed floods targeted 45.88.138.0 and 45.88.138.44 in a Ukrainian network.
- Arctic Wolf says both samples include inactive Ethereum Name Service C2 configuration.
Security assessment · AI, from the article
Impact: attempted unauthenticated remote code execution and botnet enrollment
| Product | Affected | Fixed in |
|---|---|---|
| PHP | exploit tooling targets 8.4.26 | 8.5.12, 8.4.27, 8.3.36, and 8.2.35 |
What to do
- 1.Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | godofthunder.st | has revealed that the botnet issues a DNS query for thunder.godofthunder[.]st, resolves it to 134.199.154[.]64, and establish a C2 chan |
| ipv4 | 1.0.0.1 | hard-coded public DNS servers such as 8.8.8.8, 1.1.1.1, and 1.0.0.1," Sophos added. "As with Mirai malware historically, this s |
| ipv4 | 102.210.149.166 | ectories hold PHP2Shell-related tooling - 206.188.197[.]105 102.210.149[.]166 122.10.110[.]72, 122.10.17[.]49 58.221.60[.]160:8000 41.2 |
| ipv4 | 103.147.220.17 | [.]87 193.47.62[.]24 2409:40d2:204e:4be:2a1f:f9c9:a055:e00b 103.147.220[.]17 The severity of the flaws has also led to several governm |
| ipv4 | 104.219.251.31 | 7[.]49 58.221.60[.]160:8000 41.223.30[.]7, 157.230.117[.]70 104.219.251[.]31 107.150.31[.]151 217.160.132[.]82 47.100.125[.]108, 54.16 |
| ipv4 | 107.150.31.151 | .]160:8000 41.223.30[.]7, 157.230.117[.]70 104.219.251[.]31 107.150.31[.]151 217.160.132[.]82 47.100.125[.]108, 54.169.109[.]7, 139.16 |
| ipv4 | 107.189.14.87 | .220[.]132 185.161.210[.]29 152.233.51[.]69 45.134.225[.]16 107.189.14[.]87 193.47.62[.]24 2409:40d2:204e:4be:2a1f:f9c9:a055:e00b 103 |
| ipv4 | 1.1.1.1 | hat includes hard-coded public DNS servers such as 8.8.8.8, 1.1.1.1, and 1.0.0.1," Sophos added. "As with Mirai malware histori |
| ipv4 | 122.10.110.72 | Shell-related tooling - 206.188.197[.]105 102.210.149[.]166 122.10.110[.]72, 122.10.17[.]49 58.221.60[.]160:8000 41.223.30[.]7, 157.2 |
| ipv4 | 122.10.17.49 | ling - 206.188.197[.]105 102.210.149[.]166 122.10.110[.]72, 122.10.17[.]49 58.221.60[.]160:8000 41.223.30[.]7, 157.230.117[.]70 104. |
| ipv4 | 134.199.154.64 | d-and-control (C2) address, establishes a TCP connection to 134.199.154[.]64, and sends an HTTP request. The malware then checks for a |
| ipv4 | 139.162.165.136 | 31[.]151 217.160.132[.]82 47.100.125[.]108, 54.169.109[.]7, 139.162.165[.]136 Defeating ASLR Protections The disclosure also coincides |
| ipv4 | 152.233.51.69 | [.]174 181.215.186[.]252 185.196.220[.]132 185.161.210[.]29 152.233.51[.]69 45.134.225[.]16 107.189.14[.]87 193.47.62[.]24 2409:40d2: |
| ipv4 | 157.230.117.70 | 10[.]72, 122.10.17[.]49 58.221.60[.]160:8000 41.223.30[.]7, 157.230.117[.]70 104.219.251[.]31 107.150.31[.]151 217.160.132[.]82 47.100 |
| ipv4 | 181.215.186.252 | ong those attempting to exploit the flaws - 87.121.84[.]174 181.215.186[.]252 185.196.220[.]132 185.161.210[.]29 152.233.51[.]69 45.134 |
| ipv4 | 185.161.210.29 | flaws - 87.121.84[.]174 181.215.186[.]252 185.196.220[.]132 185.161.210[.]29 152.233.51[.]69 45.134.225[.]16 107.189.14[.]87 193.47.62 |
| ipv4 | 185.196.220.132 | ng to exploit the flaws - 87.121.84[.]174 181.215.186[.]252 185.196.220[.]132 185.161.210[.]29 152.233.51[.]69 45.134.225[.]16 107.189. |
| ipv4 | 193.47.62.24 | 61.210[.]29 152.233.51[.]69 45.134.225[.]16 107.189.14[.]87 193.47.62[.]24 2409:40d2:204e:4be:2a1f:f9c9:a055:e00b 103.147.220[.]17 T |
| ipv4 | 206.188.197.105 | g for PHP 8.4.26 on an exposed attacker-controlled server ("206.188.197[.]105:9999"), alongside three screening scripts that check live |
| ipv4 | 217.160.132.82 | .30[.]7, 157.230.117[.]70 104.219.251[.]31 107.150.31[.]151 217.160.132[.]82 47.100.125[.]108, 54.169.109[.]7, 139.162.165[.]136 Defea |
| ipv4 | 217.60.242.76 | ate from the following three IP addresses - 85.11.167[.]243 217.60.242[.]76 45.198.224[.]169 These attack sources have been found to |
| ipv4 | 41.223.30.7 | [.]166 122.10.110[.]72, 122.10.17[.]49 58.221.60[.]160:8000 41.223.30[.]7, 157.230.117[.]70 104.219.251[.]31 107.150.31[.]151 217.1 |
| ipv4 | 45.134.225.16 | 86[.]252 185.196.220[.]132 185.161.210[.]29 152.233.51[.]69 45.134.225[.]16 107.189.14[.]87 193.47.62[.]24 2409:40d2:204e:4be:2a1f:f9 |
| ipv4 | 45.198.224.169 | lowing three IP addresses - 85.11.167[.]243 217.60.242[.]76 45.198.224[.]169 These attack sources have been found to contact 92.118.11 |
| ipv4 | 45.88.138.44 | s located within a single Ukrainian network - 45.88.138[.]0 45.88.138[.]44 The lack of a successful attack leveraging PHP2Shell in t |
| ipv4 | 47.100.125.108 | 117[.]70 104.219.251[.]31 107.150.31[.]151 217.160.132[.]82 47.100.125[.]108, 54.169.109[.]7, 139.162.165[.]136 Defeating ASLR Protect |
| ipv4 | 54.169.109.7 | 51[.]31 107.150.31[.]151 217.160.132[.]82 47.100.125[.]108, 54.169.109[.]7, 139.162.165[.]136 Defeating ASLR Protections The disclos |
| ipv4 | 58.221.60.160 | 197[.]105 102.210.149[.]166 122.10.110[.]72, 122.10.17[.]49 58.221.60[.]160:8000 41.223.30[.]7, 157.230.117[.]70 104.219.251[.]31 107 |
| ipv4 | 85.11.167.243 | found to originate from the following three IP addresses - 85.11.167[.]243 217.60.242[.]76 45.198.224[.]169 These attack sources hav |
| ipv4 | 87.121.84.174 | addresses as among those attempting to exploit the flaws - 87.121.84[.]174 181.215.186[.]252 185.196.220[.]132 185.161.210[.]29 152. |
| ipv4 | 8.8.8.8 | n logic that includes hard-coded public DNS servers such as 8.8.8.8, 1.1.1.1, and 1.0.0.1," Sophos added. "As with Mirai malwar |
| ipv4 | 92.118.112.100 | 8.224[.]169 These attack sources have been found to contact 92.118.112[.]100 to retrieve a loader, which is responsible for deploying |
From the original article
8 min read at thehackernews.com
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9. 2), which can result in unauthenticated remote
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.