Attackers use public PHP2Shell exploits against university and business sites
Original title: Hackers Weaponize Public PHP2Shell Exploit Code to Target Universities and Business Websites
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated command execution; fixed PHP builds shipped on October 21.
Attackers are using public exploit code for two critical PHP engine flaws, nicknamed PHP2Shell, against university and business websites. Both are scored CVSS v4.0 9.2 and can let an outsider run commands without logging in. PHP published fixes on October 21, while Amazon Threat Intelligence says probing began on October 17. Patching is described as the only complete fix; a temporary upload-progress setting only lowers risk.
Unconfirmed: Sophos reported scanning and failed tries but no confirmed successful Potassium compromise.
- Fixed releases named are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- Risk is rated highest for Apache servers running PHP as mod_php.
- PHP 8.1 and earlier need a vendor backport or a supported upgrade.
- Hunt.io recorded three exploit toolkits on October 21.
- Sophos found no proof a Potassium Mirai sample successfully compromised customers.
Impact: Unauthenticated remote command execution on the server
| Product | Affected | Fixed in |
|---|---|---|
| PHP | — | 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
- 1.Upgrade PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart services.
- 2.Confirm PHP-FPM, Apache modules, containers, and appliances run the fixed build.
- 3.Review logs for POST requests containing PHP_SESSION_UPLOAD_PROGRESS.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | thunder.godofthunder.st | tener.py and i097_listener80.py on ports 80 and 8888 Domain thunder[.]godofthunder[.]st Linked to the Potassium Mirai variant targeting Ukraini |
| ipv4 | 122.10.130.72 | [.]7 Serves history.json tied to exploitation attempts IPv4 122[.]10[.]130[.]72 Hosts exp_83.php, a PHP serialization payload IPv4 19 |
| ipv4 | 124.221.46.164 | exploit requests (body text lists 85[.]11[.]163[.]243) IPv4 124[.]221[.]46[.]164 Open directory hosting i097_listener.py and i097_list |
| ipv4 | 195.245.112.63 | 130[.]72 Hosts exp_83.php, a PHP serialization payload IPv4 195[.]245[.]112[.]63 Outdated PHP service on port 8082, flagged High Risk |
| ipv4 | 206.188.197.105 | compromise (IoCs):- Type Indicator Context from source IPv4 206[.]188[.]197[.]105 Mirai variant C2 and mass target list host; also host |
| ipv4 | 41.223.30.7 | st; also hosts php2shell_mass.py and junare_exploit.py IPv4 41[.]223[.]30[.]7 Serves history.json tied to exploitation attempts IPv |
| ipv4 | 85.11.163.243 | 43 Open directory showing exploit requests (body text lists 85[.]11[.]163[.]243) IPv4 124[.]221[.]46[.]164 Open directory hosting i09 |
| ipv4 | 85.11.167.243 | ce on port 8082, flagged High Risk for Keitaro malware IPv4 85[.]11[.]167[.]243 Open directory showing exploit requests (body text li |
From the original article
4 min read at cybersecuritynews.com
Hackers are now using public exploit code to break into websites that run PHP, and universities and business sites are among the main targets. The bugs behind this wave are two critical flaws in the PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both carry a CVSS v4.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.