Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCcritical

PHP2Shell draws millions of attempts; no confirmed RCE yet

Original title: PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet

Security Affairsby Pierluigi Paganini ()4 min read3 · 1 read
Read at securityaffairs.com
Part of a story covered by 12 sourcesPHP patches PHP2Shell; scans continue without confirmed compromiseMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while Censys still counts over 34.4 million vulnerable services.

PHP issued emergency patches on October 21 for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), unauthenticated remote code execution in the engine via crafted HTTP requests, present since PHP 5.4. Cloudflare saw attempts rise from thousands before disclosure to millions by October 22. Honeypots and Sophos report scanning, fingerprinting and botnet delivery, but no confirmed successful remote code execution. VulnCheck published an exploit that chains both bugs to bypass ASLR.

Unconfirmed: No successful remote code execution has been confirmed in real attacks, though exploit attempts number in the millions.

Key facts
  • Censys counted over 34.4 million PHP services still on vulnerable versions as of October 23.
  • Older lines 7.4, 8.0 and 8.1 need distributor fixes or an upgrade to a supported release.
  • A blocked payload was an expanded Mirai variant called Potassium with DDoS and fallback DNS.
  • Arctic Wolf said ENS-based C2 resolution exists in samples but is disabled.
  • Governments, hospitals and schools in Asia, Europe and North America took some services offline.
Security assessment · AI, from the articlePublic proof of concept

Impact: Unauthenticated remote code execution via crafted HTTP requests

ProductAffectedFixed in
PHPevery version that handles web requests, bug dating to PHP 5.4; 7.4, 8.0 and 8.1 lack upstream fixes8.2.35, 8.3.36, 8.4.27, 8.5.12
What to do
  1. 1.Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or apply distributor fixes for 7.4, 8.0 and 8.1.
  2. 2.Treat scanning and Potassium/Mirai delivery attempts as active even though RCE success is unconfirmed.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-109618CVE-2026-109619
ATT&CK
T1190 Exploit Public-Facing ApplicationT1498 Network Denial of Service
Tags
phpphp2shellrcemiraipotassiumcensys
Vendors
PHP
Malware
PotassiumMirai
Organizations
CloudflareCensysSophosVulnCheckArctic WolfCisco Talos

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109619
+1 related CVE
CVE-2026-109618
Use-after-free RCE in PHP via stale request globals
9.2100%PoC ×13

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
ipv41.1.1.1llback DNS resolution using public servers like 8.8.8.8 and 1.1.1.1 hardcoded as backup. PHP2Shell is being compared to Log4She
ipv48.8.8.8ities and fallback DNS resolution using public servers like 8.8.8.8 and 1.1.1.1 hardcoded as backup. PHP2Shell is being compare

From the original article

4 min read at securityaffairs.com

PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately. On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.

Security Affairs

By Pierluigi Paganini · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.