Public PHP2Shell exploit code used in failed Potassium botnet attempts
Original title: Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware
Sophos found scanning and failed attempts, not a confirmed compromise; PHP fixed the flaws on October 21.
Public proof-of-concept code is available for PHP2Shell, CVE-2026-109618 and CVE-2026-109619, both scored CVSS 9.2 and able to run code without login on PHP that serves web requests. Sophos said an October 22 correction showed scanning and a small number of failed attempts, with no evidence of successful compromise; controls blocked a Potassium payload described as a likely Mirai variant. PHP published fixes on October 21. Administrators should update bundled runtimes, containers, and appliances as well as host PHP.
Unconfirmed: Sophos withdrew an earlier success claim and reports only failed attempts, not confirmed compromise.
- Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, or an approved backport.
- Apache mod_php is called highest risk because exploitation can precede application code.
- Amazon observations of PHP attacks date to October 17, before the public fixes.
- Potassium checks downloads for Linux ELF bytes and can launch denial-of-service traffic.
Impact: Unauthenticated code execution; blocked attempt to deliver botnet malware
| Product | Affected | Fixed in |
|---|---|---|
| PHP | Installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed | 8.5.12, 8.4.27, 8.3.36, or 8.2.35 |
- 1.Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or an approved vendor backport, then restart workers.
- 2.If patching is delayed, remove exposed PHP from the internet or require network-level authentication.
- 3.Check bundled, container, and appliance PHP copies separately from the host package.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1105 Ingress Tool TransferT1498 Network Denial of Service
- Vendors
- PHP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | hackattackkaboom.botlesscucks.st | ]godofthunder[.]st Contacted during sandbox analysis Domain hackattackkaboom[.]botlesscucks[.]st Related malware staging server Domain hik[.]gettinghead |
| domain | hik.gettingheadfromduckysmom.st | m[.]botlesscucks[.]st Related malware staging server Domain hik[.]gettingheadfromduckysmom[.]st Potassium infrastructure embedded in payload MD5 b61a09 |
| domain | thunder.godofthunder.st | -control IP 117[.]55[.]202[.]115 Potassium C2 server Domain thunder[.]godofthunder[.]st Contacted during sandbox analysis Domain hackattackkabo |
| ipv4 | 117.55.202.115 | .]199[.]154[.]64 Potassium C2 server Command-and-control IP 117[.]55[.]202[.]115 Potassium C2 server Domain thunder[.]godofthunder[.]s |
| ipv4 | 134.199.154.64 | fs Related malware download location Command-and-control IP 134[.]199[.]154[.]64 Potassium C2 server Command-and-control IP 117[.]55[. |
| ipv4 | 45.198.224.169 | compromise (IoCs):- Type Indicator Source context Source IP 45[.]198[.]224[.]169 PHP2Shell exploit attempt Payload-hosting IP 92[.]118 |
| ipv4 | 92.118.112.100 | 98[.]224[.]169 PHP2Shell exploit attempt Payload-hosting IP 92[.]118[.]112[.]100 Related payload infrastructure Payload URL hxxp://92[ |
| md5 | b61a098fc62a2c2696e196dca78da71a | ysmom[.]st Potassium infrastructure embedded in payload MD5 b61a098fc62a2c2696e196dca78da71a Related likely Mirai-variant sample SHA-1 c472dab4ff7c16782 |
| sha1 | c472dab4ff7c16782a8037f988d4daa6d4bdb343 | 696e196dca78da71a Related likely Mirai-variant sample SHA-1 c472dab4ff7c16782a8037f988d4daa6d4bdb343 Related likely Mirai-variant sample SHA-256 0c5486f06620e26 |
| sha256 | 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 | 8d4daa6d4bdb343 Related likely Mirai-variant sample SHA-256 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 Related likely Mirai-variant sample File path /tmp/nfs Publ |
| url | http://92.118.112.100/nfs | ]118[.]112[.]100 Related payload infrastructure Payload URL hxxp://92[.]118[.]112[.]100/nfs Related malware download location Command-and-control |
From the original article
4 min read at cybersecuritynews.com
Public proof-of-concept code for two critical PHP vulnerabilities is now available, and attackers have tried to use the flaws to deploy botnet malware. Known together as PHP2Shell, CVE-2026-109618 and CVE-2026-109619 both carry a CVSS severity score of 9. 2 and can allow attackers to run code without logging in.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.