Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
Two days after PHP released emergency fixes for critical PHP2Shell vulnerabilities, threat actors attempted to spread the Mirai botnet using these flaws, while researchers developed exploits to bypass key memory protections.
The vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were discovered by Wiz, OpenAI and Calif in August and patched on October 21 with versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Each has a CVSS v4.0 score of 9.2. Amazon spotted the first exploitation attempt on October 17, with attack activity surging once the fixes went public.
The threat has prompted many organizations to take systems offline as a precaution. Several government, school and hospital websites in Europe went dark on October 21, and the UK government reported 32 of its services were unavailable and four partly unavailable, mostly due to precautionary measures while patches were applied.
Mirai Botnet Linked to Exploitation
Sophos reports that threat actors have attempted to leverage PHP2Shell to install Potassium, which the firm believes is a variant of the Mirai botnet. The attempt Sophos analyzed was stopped before the malware reached the targeted system. Sophos describes the sample as an updated build with more functionality of a Mirai-derived strain first identified in early 2026.
The lack of successful exploits in the wild suggests threat actors are also struggling.
Arctic Wolf connected two Potassium binaries to servers hosting PHP2Shell payloads, though it noted its data doesn't show the PHP2Shell requests actually running the malware. Hunt.io attributed observed PHP2Shell traffic to an established Mirai-style botnet active since at least May 2026 that recently added these flaws to its spreading methods.
Exploit Development Continues
Despite no confirmed breaches, researchers have developed sophisticated exploits. VulnCheck created an exploit for CVE-2026-109618 that achieves remote code execution on x86-64 systems with ASLR enabled and PHP error display turned off—the recommended production setup.
SOCRadar discovered PHP2Shell tooling on an attacker-controlled server with publicly browsable working files. The operator had developed an exploit chain for PHP 8.4.26 on Apache mod_php, which they tested in a lab and marketed as a "one-click" exploit. However, the configuration required is uncommon and more typical of test systems than hardened production environments.
Patching Progress Lags
Qualys analyzed anonymized data from 12,000 customers and found only 199,000 PHP instances were patched within 12 hours of disclosure. Roughly 110 million instances (71%) run PHP versions 5.4 through 8.1, which are past end of life and won't receive vendor patches. Another 44 million instances run supported PHP branches for which fixes exist but hadn't been applied as of October 23.
CISA had not added either vulnerability to its Known Exploited Vulnerabilities (KEV) catalog by the morning of October 23. Censys is tracking patching progress for PHP2Shell in real time through a public dashboard showing how many internet-facing PHP services still run vulnerable versions.
Related
