Tahdid aktorlari yangi e'lon qilingan PHP2Shell zaifliklarini ekspluatatsiya qilishga muvaffaqiyatsiz urinishlari kuzatildi, bu orqali zararlangan tizimlarni Potassium deb nomlangan Mirai botnet variantiga ulashga harakat qilindi. Shu bilan birga, zaifliklardan foydalanish avval o'ylanganidan qiyinroq bo'lishi mumkinligi ma'lum bo'ldi.
Hujumlar CVE-2026-109618 va CVE-2026-109619 (CVSS ballari: 9.2) zaifliklarini ekspluatatsiya qilishga qaratilgan bo'lib, ular maxsus tayyorlangan HTTP so'rovlar orqali autentifikatsiyasiz masofaviy kod bajarish (RCE) imkonini beradi. Zaifliklar PHP 8.5.12, 8.4.27, 8.3.36 va 8.2.35 versiyalarida tuzatilgan.
"Biroq, namuna tahlili shuni ko'rsatdiki, bu 2026-yil boshida aniqlangan Mirai-dan kelib chiqqan botnet variantining yangilangan va sezilarli kengaytirilgan versiyasidir," deb aytdi Sophos. "Namuna yuklab olish va tarmoqni buzish funksiyalarini namoyish etadi."
Xususan, u qattiq kodlangan, shifrlangan buyruq va nazorat (C2) manzilini hal qiladi, 134.199.154[.]64 ga TCP ulanishini o'rnatadi va HTTP so'rov yuboradi. Zararli dastur keyin HTTP 200 javob holatini tekshiradi va natijaviy yuk 7F 45 4C 46 (ELF sehrli baytlari) bilan boshlanishini tasdiqlaydi, bu Linux ELF binar faylini keyingi yuk sifatida kutishini ko'rsatadi.
"Rezolver funksiyasi IPv4 manzillarini va xost nomlarini hal qilishni qo'llab-quvvatlaydi, qo'shimcha zaxira hal qilish mantig'i bilan birga, jumladan 8.8.8.8, 1.1.1.1 va 1.0.0.1 kabi qattiq kodlangan umumiy DNS serverlari," deb qo'shdi Sophos. "Mirai zararli dasturi tarixan bo'lgani kabi, bu namuna DDoS hujumlarini amalga oshirishi mumkin."
Hujumlar quyidagi uchta IP manzildan kelib chiqqanligi aniqlangan:
- 85.11.167[.]243
- 217.60.242[.]76
- 45.198.224[.]169
Bu hujum manbalari 92.118.112[.]100 bilan bog'lanib, yuklovchini olishgan, bu esa Mirai botnet variantini joylashtirish uchun javobgar. Tarmoq bilan cheklangan sandbox ichida artefaktning keyingi tahlili shuni ko'rsatdiki, botnet thunder.godofthunder[.]st uchun DNS so'rov yuboradi, uni 134.199.154[.]64 ga hal qiladi va TCP porti 50792 da C2 kanalini o'rnatadi.
Yakuniy maqsad — bitta Ukraina tarmog'i ichida joylashgan ikkita qo'shni xostga qarshi doimiy volumetrik to'fon hujumlarini boshlash:
- 45.88.138[.]0
- 45.88.138[.]44
Yovvoyi tabiatda PHP2Shell dan foydalangan muvaffaqiyatli hujumning yo'qligi tahdid aktorlari ishonchli ekspluatatsiyalarni ishlab chiqishda "qiynalayotganini" ko'rsatadi, deb qo'shdi Sophos.
Potassium birinchi marta botnet kuzatuv platformasi Synthient tomonidan 2026-yil mart oyida e'lon qilingan. Keyingi tahlilda Nokia Deepfield tadqiqotchilari zararli dasturini Mirai fork sifatida ta'rifladilar, u "statik konfiguratsiya jadvali uchun ChaCha20 (bu Mirai variantida birinchi marta ChaCha20 shu tarzda ishlatilishi), simda hamma narsa uchun bitta statik bayt (0xED), hujum buyruqlari bilan bir xil kanalda nomlangan teskari qobiq protokoli (SHELL / SHOUT) va har bir hal qilingan A yozuvining ikkita 16-bitli yarmini ulanishdan oldin almashtiradigan DNS noto'g'ri yo'naltirish sxemasidan foydalanadi."
Arctic Wolf, xuddi shu qurollangan PHP2Shell ekspluatatsiya urinishining qo'shimcha tafsilotlarini ham baham ko'rdi, botnet ICMP, TCP, UDP va OpenVPN protokollari orqali to'fon hujumlarini osonlashtirish uchun 24 ta buyruqni qo'llab-quvvatlashini aytdi. ARM va x86 uchun ikkala qurilish ham Ethereum Name Service (ENS) orqali C2 infratuzilmasini hal qilish konfiguratsiyasini o'z ichiga oladi.
"ENS hal qilish ikkala namunada ham o'chirilgan edi, bu qobiliyat mavjud, lekin faol emasligini ko'rsatadi," deb aytdi kiberxavfsizlik firmasi. "Agar kelajakdagi variantlarda yoqilsa, bu registratorlar va DNS provayderlariga bog'liqlikni kamaytirish orqali buzishni murakkablashtirishi mumkin, bu esa himoyachilarni ENS nomlarini, RPC infratuzilmasini va hal qilingan buyruq va nazorat manzillarini bloklashga majbur qiladi."
Tahdid Aktori PHP2Shell ni Keng Ko'lamda Ekspluatatsiya Qilmoqda
Bu rivojlanish SOCRadar PHP 8.4.26 uchun PHP2Shell ekspluatatsiya vositalarini hujumchi nazoratidagi ochiq serverda ("206.188.197[.]105:9999") topganligi bilan bir vaqtda sodir bo'ldi, shuningdek, PHP2Shell zanjiri bog'liq bo'lgan oldindan shartlarni tekshiradigan uchta skanerlash skripti ham topildi.
Kiberxavfsizlik kompaniyasiga ko'ra, skriptlar taxminan 20 ta umumiy veb-saytni ekspluatatsiya uchun zarur bo'lgan PHP versiyasi, server sozlamalari va sessiya sozlamalari uchun tekshirdi. Bu veb-saytlar Kanada, Xitoy, Finlandiya, Fransiya, Polsha, Buyuk Britaniya va AQShni qamrab oladi.
"Markaziy fayl, aslrexploit.py, operator PHP 8.4.26 uchun Apache modphp ostida 'bir marta bosish' PHP2Shell ekspluatatsiyasi deb belgilagan Python ekspluatatsiyasidir," deb aytdi SOCRadar. "U oddiy HTTP so'rovlar orqali uchta keng qadamda ishlaydi: u maqsadning PHP ishchisini qayta ishlatadi, sessiya cookie orqali xotira manzillarini sizdirib, manzil maydoni tartibini tasodifiylashtirish (ASLR) ni yengadi va keyin PHP sessiya yuklash jarayonini suiiste'mol qilib, qobiq buyrug'ini bajaradi."
ASLR, ya'ni Manzil Maydoni Tartibini Tasodifiylashtirish, tizim fayllari va dasturlar har safar ishga tushirilganda ishlatiladigan xotira joylarini tasodifiylashtiradigan kiberxavfsizlik mexanizmidir, bu esa hujumchilarga kod qayerda yuklanishini bashorat qilishni qiyinlashtiradi. Bu o'rnatilgan himoya xotiraga asoslangan ekspluatatsiyalardan, masalan, bufer-to'lib ketish hujumlaridan himoya qilishga yordam beradi.
Boshqa uchta hamroh skriptlar quyidagilar:
- php2shell_fp.py, taxminan 20 ta saytdan PHP versiyasi va server sozlamalarini o'qiydi
- deep_probe.py, 11 ta saytni ko'rinadigan xatolar, phpinfo sahifalari, fayl kiritish va sessiya in'ektsiyasi uchun tekshiradi, ular ekspluatatsiya shartlariga mos kelishini aniqlash uchun
- wp_attack.py, beshta WordPress saytiga e'tibor qaratib, foydalanuvchi va plagin ro'yxatini o'tkazadi
Shunga qaramay, 2026-yil 22-oktabr holatiga ko'ra, hech bir tekshirilgan saytda qobiq kirishining dalili yo'q, bu maqsadli saytlar ekspluatatsiya shartlariga mos kelmaganligini ko'rsatadi.
Asboblar to'plami hujumchi veb-saytlarning mijoz tomonidagi JavaScript dan API kalitlari va orqa tomon URL larini ajratib olish, veb va API yo'llarini autentifikatsiyasiz kirish uchun tizimli ravishda tekshirish va trafikni tarqatish hamda tezlik cheklovlari va bloklashdan qochish uchun aylanuvchi proksi hovuzidan foydalanishni o'z ichiga olgan kengroq operatsiyaning bir qismi deb baholanadi.
"Serverdagi bog'liq artefaktlar qo'shimcha ravishda veb-arxiv razvedkasi va avtomatlashtirilgan CAPTCHA yechimini ko'rsatadi," deb ta'kidladi SOCRadar. "Birgalikda, asboblar to'plami kriptovalyuta va Web3 maqsadlariga qaratilgan moliyaviy motivatsiyali aktorga ishora qiladi."
Xuddi shu ekspluatatsiya serveri ("206.188.197[.]105") Hunt.io tomonidan ham e'lon qilingan, bu operatsiya ortidagi tahdid aktori bulut, umumiy xosting va ISP tarmoqlari bo'ylab 123 ta serverni nishonga olganini aytdi. "Taxminan 57 tasi PHP ni ishlatadi, ko'pchiligi qo'llab-quvvatlanmaydigan 5.x dan 7.x gacha," deb aytdi tahdid razvedkasi firmasi. "O'nta so'rovni butunlay rad etdi, jumladan, Cloudflare ortida joylashgan beshtadan uchtasi. Hech biri ekspluatatsiya qilinmagan."
Umumiy hisobda, 10 ta ochiq katalog PHP2Shell bilan bog'liq asboblarni o'z ichiga oladi:
- 206.188.197[.]105
- 102.210.149[.]166
- 122.10.110[.]72, 122.10.17[.]49
- 58.221.60[.]160:8000
- 41.223.30[.]7, 157.230.117[.]70
- 104.219.251[.]31
- 107.150.31[.]151
- 217.160.132[.]82
- 47.100.125[.]108, 54.169.109[.]7, 139.162.165[.]136
ASLR Himoyalarini Yengish
Bu e'lon shuningdek, PHP2Shell ekspluatatsiyasining ASLR yoqilgan x86-64 tizimlarida PHP ning tavsiya etilgan ishlab chiqarish konfiguratsiyasi bilan masofaviy kod bajarishga erishishi mumkinligini ko'rsatadigan rivojlanish bilan bir vaqtda sodir bo'ldi.
"Eng katta to'siqlardan biri manzil maydoni tartibini tasodifiylashtirish (ASLR) bo'ldi, bu xotira buzilish zaifliklarini ekspluatatsiya qilishni ancha qiyinlashtirish uchun mo'ljallangan himoya," deb aytdi Spencer McIntyre, VulnCheck da ekspluatatsiya rivojlantirish direktori, The Hacker News ga.
"Bizning jamoa yangi texnikani ishlab chiqdik [...] bu ikkita zaiflikni birlashtirib, xotira sizdirishidan foydalanib ASLR ni chetlab o'tadi va x86-64 tizimlarida, hatto PHP ning tavsiya etilgan ishlab chiqarish xato ko'rsatish sozlamasi bilan ham masofaviy kod bajarishga erishadi."
"Biz xuddi shu sharoitlarda buni amalga oshiradigan boshqa umumiy yoki tijorat ekspluatatsiyasini aniqlamadik. Bu qobiliyatni rivojlantirish oson emas edi, lekin bu PHP2Shell ni ishlab chiqarish sozlamalari bilan tizimlarda ekspluatatsiya qilishning asosiy to'sig'ini yengish mumkinligini ko'rsatadi."
Zaifliklardan muvaffaqiyatli foydalanish oqibatlari jiddiy, chunki bu hujumchiga veb-ilova ruxsatlari bilan kod bajarish imkonini beradi, bu esa API kalitlari, ma'lumotlar bazasi ulanishlari va ilova erisha oladigan boshqa ichki xizmatlarga kirish imkonini beradi, deb aytdi VulnCheck.
"Hujumchiga sezilarli zarar yetkazish uchun administrator yoki root kirishi shart emas," deb aytdi McIntyre. "Zaif veb-ilovaga kirish tashkilot infratuzilmasining boshqa qismlariga kirish nuqtasini ta'minlashi mumkin."
Ekspluatatsiya Urinishlari Ko'p, Hech Biri Muvaffaqiyatli Emas
Topilmalar zaifliklarga qarshi keng ko'lamli ekspluatatsiya urinishlari davom etayotganini ko'rsatadigan hisobotlar bilan mos keladi, jumladan, Xitoydan kelgan IP manzil server tomonidagi sessiya fayli orqali veb-qobiqni tushirishga urinish kuzatilgan.
Veb infratuzilma kompaniyasi Cloudflare zaifliklar ommaviy e'lon qilinganidan 45 daqiqa o'tgach, zaiflikni ekspluatatsiya qilishga o'n minglab urinishlar kuzatilganini, 2 soat ichida yuz minglabga ko'tarilganini va 2026-yil 22-oktabr erta tongida millionlabga yetganini aytdi.
"Hozircha, faoliyatning aksariyati skanerlash, shuningdek, turli yuklarni yetkazish bo'yicha ba'zi muvofiqlashtirilmagan urinishlardir," deb aytdi Cisco Talos. "Bu kutilgan: umumiy isbot-konsept (PoC) kodi bilan skanerlash yoki asosiy ekspluatatsiya qilish, zaiflikni aktorning o'z asboblariga integratsiya qilishdan ancha kam kuch talab qiladi."
Previdian telemetriyasidan olingan ma'lumotlar hozirgacha CVE-2026-109618 ga qarshi o'nlab IP manzillardan yuzlab ekspluatatsiya urinishlarini, CVE-2026-109619 ga esa kamroq darajada qayd etgan. CVE-2026-109618 ga qaratilgan birinchi ekspluatatsiya hodisasi 2026-yil 21-oktabrda, soat 13:05 UTC da qayd etilgan.
"Biz o'z honeypotlarimizda ko'plab PHP2Shell tekshiruvlari va ekspluatatsiya urinishlarini kuzatdik," deb aytdi Previdian. "Yozish vaqti holatiga ko'ra, biz muvaffaqiyatli masofaviy kod bajarish va tushirilgan PHP fayllarini kuzatmadik. Ishonchli RCE avval o'ylanganidan qiyinroq bo'lishi mumkin."
Bu baholash Beelzebub, Dataminr va Wordfence tomonidan ham tasdiqlangan, kuzatilgan faoliyat hozirgacha skanerlash, barmoq izini olish va buyruq bajarilishini tasdiqlash, atrof-muhit o'zgaruvchilaridan ma'lumot va sirlarni o'g'irlash, doimiy kirishni o'rnatish va ikkinchi bosqich yukini olish va bajarish urinishlari bilan cheklangan.
Wordfence zaifliklarni ekspluatatsiya qilishga urinish qilayotgan IP manzillarni quyidagicha baham ko'rdi:
- 87.121.84[.]174
- 181.215.186[.]252
- 185.196.220[.]132
- 185.161.210[.]29
- 152.233.51[.]69
- 45.134.225[.]16
- 107.189.14[.]87
- 193.47.62[.]24
- 2409:40d2:204e:4be:2a1f:f9c9:a055:e00b
- 103.147.220[.]17
Zaifliklarning jiddiyligi Osiyo, Yevropa va Shimoliy Amerika bo'ylab bir nechta hukumat, maktab va shifoxona veb-saytlarining ehtiyot chorasi sifatida oflayn bo'lishiga olib keldi. Buyuk Britaniya hukumati 32 ta raqamli xizmat mavjud emasligi va to'rttasi qisman mavjud emasligini tasdiqladi, bu asosan xavfsizlik yangilanishlari va yumshatish choralari qo'llanilayotganda ehtiyot chorasi sifatida o'chirilishidan kelib chiqqan. Milliy Kiberxavfsizlik Markazi (NCSC) biznes va boshqa tashkilotlarga taxminan 50 000 ta ogohlantirish yuborgan.
"Zaif kod PHP 5.4 ga, 2012-yilda chiqarilgan versiyaga borib taqaladi," deb aytdi Sysdig Threat Research Team. "Xatolar PHP dvigatelida, har qanday ilova ichida emas. Shu sababli, toza ilova kodiga ega har qanday WordPress, Drupal yoki Joomla sayti hali ham ochiq."
Eski PHP versiyalari uchun tuzatishlar mavjud emasligi sababli, PHP2Shell Log4Shell ga o'xshash uzoq muddatli ta'sirga ega bo'lishi kutilmoqda. Google ga tegishli VirusTotal dan olingan baholarga ko'ra, taxminan 272 000 ta xost qo'llab-quvvatlanadigan PHP tarmog'ini (8.2 dan 8.5 gacha) ishlatadi. PHP 7.4, 8.0 yoki 8.1 da bo'lgan tashkilotlarga qo'llab-quvvatlanadigan tarmoqqa o'tish yoki tarqatish orqaga qaytarishdan foydalanish tavsiya etiladi.
Hujum yuzasini boshqarish platformasi Censys hozirda 4,18 milliondan ortiq xost va 67,5 million veb-xususiyat PHP ni ishlatayotganini aniqlaydi. Ulardan 34,4 milliondan ortiq PHP xizmati 2026-yil 23-oktabr holatiga ko'ra hali ham zaif deb baholanadi.
"Veb-serverlar va shunga o'xshash ko'plab ilovalar, ehtimol, tegishli sotuvchilar bu elementlarni tuzatmaguncha zaif qoladi," deb aytdi D
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shellvulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought.
The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote code execution (RCE) via specially crafted HTTP requests. The vulnerabilities have been patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
"However, analysis of the sample revealed that it is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026," Sophos said. "The sample displays downloader and network disruption functionality."
Specifically, it resolves a hard-coded, encrypted command-and-control (C2) address, establishes a TCP connection to 134.199.154[.]64, and sends an HTTP request. The malware then checks for an HTTP 200 response status and verifies that the resulting payload begins with the ELF magic bytes 7F 45 4C 46, indicating that it expects a Linux ELF binary as a follow-on payload.
"A resolver function supports IPv4 addresses and hostname resolution, with additional fallback resolution logic that includes hard-coded public DNS servers such as 8.8.8.8, 1.1.1.1, and 1.0.0.1," Sophos added. "As with Mirai malware historically, this sample can execute DDoS attacks."
The attacks have been found to originate from the following three IP addresses -
- 85.11.167[.]243
- 217.60.242[.]76
- 45.198.224[.]169
These attack sources have been found to contact 92.118.112[.]100 to retrieve a loader, which is responsible for deploying the Mirai botnet variant. Further analysis of the artifact within a network-contained sandbox has revealed that the botnet issues a DNS query for thunder.godofthunder[.]st, resolves it to 134.199.154[.]64, and establishes a C2 channel on TCP port 50792.
The end goal is to launch sustained volumetric flood attacks against two adjacent hosts located within a single Ukrainian network -
- 45.88.138[.]0
- 45.88.138[.]44
The lack of a successful attack leveraging PHP2Shell in the wild suggests that threat actors are "struggling" to come up with reliable exploits, Sophos added.
Potassium was first flagged by botnet tracking platform Synthient in March 2026. In a follow-up analysis, Nokia Deepfield researchers described the malware as a Mirai fork which uses "ChaCha20 for the static config table (the first time we have seen ChaCha20 used this way in a Mirai variant), a single static byte (0xED) for everything on the wire, a named reverse-shell protocol (SHELL / SHOUT) on the same channel as attack commands, and a DNS misdirection scheme that swaps the two 16-bit halves of every resolved A record before connect()."
Arctic Wolf, which also shared additional details of the same weaponized PHP2Shell exploitation attempt, said the botnet supports 24 commands to facilitate flood attacks over ICMP, TCP, UDP, and OpenVPN protocol. Both builds for ARM and x86 also contain configuration for resolving C2 infrastructure through Ethereum Name Service (ENS).
"ENS resolution was disabled in both samples, indicating that the capability was present but inactive," the cybersecurity firm said. "If enabled in future variants, it could complicate disruption by reducing reliance on registrars and DNS providers, requiring defenders to block the ENS names, RPC infrastructure, and resolved command-and-control addresses."
Threat Actor Mass Exploits PHP2Shell
The development comes as SOCRadar said it found PHP2Shell exploit tooling for PHP 8.4.26 on an exposed attacker-controlled server ("206.188.197[.]105:9999"), alongside three screening scripts that check live websites for preconditions the PHP2Shell chain depends on.
The scripts, according to the cybersecurity company, checked about 20 public websites for the PHP version, server setup, and session settings the exploit needs. These websites span Canada, China, Finland, France, Poland, the U.K., and the U.S.
"The central file, aslrexploit.py, is a Python exploit the operator labels a 'one-click' PHP2Shell exploit for PHP 8.4.26 under Apache modphp," SOCRadar said. "It works entirely over ordinary HTTP requests in three broad steps: it recycles the target's PHP worker, leaks memory addresses through the session cookie to defeat address space layout randomization (ASLR), and then abuses PHP's session upload progress handling to run a shell command."
ASLR, short for Address Space Layout Randomization, is a cybersecurity mechanism that randomizes the memory locations used by system files and programs each time they are run, making it harder for attackers to predict where code will load. This built-in defense helps defend against memory-based exploits, such as buffer-overflow attacks.
The other three companion scripts are as follows -
- php2shell_fp.py, which reads PHP version and server setup from about 20 sites
- deep_probe.py, which examines 11 of those sites for visible errors, phpinfo pages, file inclusion, and session injection to ascertain whether they meet exploit prerequisites
- wp_attack.py, which focuses on five WordPress sites to conduct user and plugin enumeration
That said, there is no evidence of shell access on any screened site as of October 22, 2026, indicating the targeted sites did not meet the exploit's preconditions.
The toolset is assessed to be part of a broader operation that involves the attacker extracting API keys and backend URLs from websites' client-side JavaScript, systematically sweeping web and API routes for unauthenticated access, and using a pool of rotating proxies to spread traffic and evade rate limits and blocking.
"Related artifacts on the server additionally point to web-archive reconnaissance and automated CAPTCHA solving," SOCRadar noted. "Taken together, the toolset points to a financially motivated actor focused on cryptocurrency and Web3 targets."
The same exploitation server ("206.188.197[.]105") has also been flagged by Hunt.io, which said the threat actor behind the operation has targeted 123 servers across cloud, shared-hosting and ISP networks. "About 57 run PHP, many on unsupported 5.x to 7.x," the threat intelligence firm said. "Ten rejected the request outright, including three of the five sitting behind Cloudflare. None was exploited."
In all, 10 open directories hold PHP2Shell-related tooling -
- 206.188.197[.]105
- 102.210.149[.]166
- 122.10.110[.]72, 122.10.17[.]49
- 58.221.60[.]160:8000
- 41.223.30[.]7, 157.230.117[.]70
- 104.219.251[.]31
- 107.150.31[.]151
- 217.160.132[.]82
- 47.100.125[.]108, 54.169.109[.]7, 139.162.165[.]136
Defeating ASLR Protections
The disclosure also coincides with the development of a PHP2Shell exploit that can achieve remote code execution on ASLR-enabled x86-64 systems with PHP's recommended production configuration.
"One of the biggest obstacles has been address space layout randomization (ASLR), a protection designed to make memory corruption vulnerabilities much harder to exploit," Spencer McIntyre, director of exploit development at VulnCheck, told The Hacker News.
"Our team developed a novel technique [...] that chains the two vulnerabilities together, using a memory leak to bypass ASLR and achieve remote code execution on x86-64 systems, even with PHP's recommended production error-display setting."ir
"We haven't identified another public or commercial exploit that achieves this under the same conditions. Developing this capability was far from trivial, but it demonstrates that a major barrier to exploiting PHP2Shell on production-configured systems can be overcome."
Consequences of successful exploitation of the flaws are severe, as it permits an attacker to execute code with the permissions of the web application, potentially gaining access to API keys, database connections, and other internal services the application can reach, VulnCheck said.
"An attacker doesn't necessarily need administrator or root access to cause significant damage," McIntyre said. "Access to a vulnerable web application could provide a foothold into other parts of an organization's infrastructure."
Exploit Attempts Plenty, None Successful
The findings dovetail with reports indicating that broad exploitation attempts targeting the flaws are underway, including by a China-based IP address that has been observed trying to drop a web shell via a server-side session file.
Web infrastructure company Cloudflare said it observed tens of thousands of attempts to exploit the flaw 45 minutes after the flaws were publicly announced, before climbing to hundreds of thousands within 2 hours and millions as of early October 22, 2026.
"So far, most of the activity is scanning, along with some uncoordinated attempts to deliver various payloads," Cisco Talos said. "This is expected: scanning or basic exploitation with public proof-of-concept (PoC) code takes far less effort than integrating a vulnerability into an actor's own tooling."
Data from Previdian's telemetry has so far recorded hundreds of exploitation attempts targeting CVE-2026-109618 from dozens of IP addresses, and against CVE-2026-109619 to a lesser degree. The first exploit event aimed at CVE-2026-109618 was recorded on October 21, 2026, at 1:05 p.m. UTC.
"We've seen plenty of PHP2Shell probes and exploitation attempts in our honeypots," Previdian said. "At the time of writing, we've observed no successful remote code execution and no dropped PHP files. Reliable RCE may be harder to achieve than initially expected."
This assessment has also been echoed by Beelzebub, Dataminr, and Wordfence, with observed activity so far limited to scanning, fingerprinting, and attempts to confirm command execution, steal credentials and secrets from environment variables, install persistent access, and retrieve and execute a second-stage payload.
Wordfence has shared the following IP addresses as among those attempting to exploit the flaws -
- 87.121.84[.]174
- 181.215.186[.]252
- 185.196.220[.]132
- 185.161.210[.]29
- 152.233.51[.]69
- 45.134.225[.]16
- 107.189.14[.]87
- 193.47.62[.]24
- 2409:40d2:204e:4be:2a1f:f9c9:a055:e00b
- 103.147.220[.]17
The severity of the flaws has also led to several government, school and hospital websites going offline across Asia, Europe, and North America out of an abundance of caution. The U.K. government has confirmed that 32 digital services are unavailable and four are partially unavailable, largely stemming from the precautionary shutdowns while security updates and mitigations were applied. The National Cyber Security Centre (NCSC) has issued approximately 50,000 warnings to businesses and other organizations.
"The vulnerable code dates back to PHP 5.4, released in 2012," the Sysdig Threat Research Team said. "The bugs live in the PHP engine, not within any application. For that reason, any WordPress, Drupal, or Joomla site with clean application code is still exposed."
With the fixes not available for older versions of PHP, PHP2Shell is expected to have a long tail, along the lines of Log4Shell. According to estimates from Google-owned VirusTotal, about 272,000 hosts run a supported PHP branch (8.2 to 8.5), Organizations on PHP 7.4, 8.0, or 8.1 are advised to move to a supported branch, or use a distribution backport.
Attack surface management platform Censys said it currently detects over 4.18 million hosts and 67.5 million web properties running PHP. Of these, more than 34.4 million PHP services are still assessed to be vulnerable as of October 23, 2026.
"Many applications with web servers and similar will likely remain vulnerable until their respective vendors patch these items," Dataminr said. "The implications of this are that many organizations will likely remain vulnerable to some degree for far longer than when patches are directly applied to owned and managed applications."
(The story was updated after publication to revise Censys's host and web property counts based on its improvements to PHP detection logic.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.