Critical PHP2Shell Exploit Code Leaked as Hackers Attempt Botnet Deployment

Public proof-of-concept code for two serious PHP vulnerabilities has been published, and there are reports that attackers have attempted to use the flaws to install botnet malware.

Grouped as PHP2Shell, CVE-2026-109618 and CVE-2026-109619 each carry a CVSS score of 9.2 and can enable unauthenticated remote code execution.

Attempted exploitation should not be conflated with confirmed successful compromise. In a correction issued on October 22 at 21:21 UTC, Sophos reported that its telemetry showed scanning activity and a small number of failed exploit attempts.

Sophos found no evidence these vulnerabilities were used to successfully breach customer systems. The company’s researchers identified the intended payload as “Potassium,” a likely Mirai-derived botnet variant. Security controls blocked the delivery, so the malware was not installed.

Analysis of the captured sample showed an updated Mirai-like threat with download functionality and network-disruption features.

This activity follows earlier PHP2Shell targeting that began before the public patches: researchers reported attack attempts as early as October 17, four days before the fixes were released. These findings reinforce the need to review historical logs while keeping attempted attacks distinct from proven code execution on production servers.

Critical PHP2Shell exploit code goes public

PHP published security updates on October 21. Affected configurations include PHP instances serving web requests via PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.

The Dutch National Cyber Security Centre has warned that Apache mod_php poses the highest risk because exploitation can occur before application code runs.

The two flaws stem from different failures in how PHP manages memory and request data. CVE-2026-109618 can corrupt memory during request cleanup after an out-of-memory condition. CVE-2026-109619 involves stale request data remaining in shared internal state that a later request handled by the same worker process can reuse.

Because many products bundle PHP, including management interfaces and network appliances, vendors that supply bundled runtimes may also need to issue updates. Administrators should check which PHP runtime each service is actually using rather than relying solely on the version reported by a command-line check.

Public exploit code does not imply that every vulnerable server can be reliably compromised. Sophos noted that their researchers found exploiting the flaws to be difficult even with AI assistance. Previous coverage from Cloudflare also emphasizes that web application firewall rules are a temporary mitigation, not a substitute for applying updates.

Potassium botnet payload examined

The blocked exploit traffic observed by Sophos included a scanning-related User-Agent, a multipart boundary string, and a distinct POST request pattern. Sophos published the temporary file path and an execution command observed as related indicators, but later withdrew an earlier claim that customer systems had executed the payload; those details therefore should not be treated as proof of successful infection.

Sample analysis shows Potassium resolves an encrypted command-and-control address and attempts an HTTP fetch. The downloader verifies an HTTP 200 response and checks that the returned file begins with ELF magic bytes, indicating it expects another Linux executable rather than ordinary web content. The sample supports hostname resolution with fallback lookups using public DNS services.

Use of public DNS services for resolution is not, by itself, a sign of maliciousness. Like other Mirai-based families, Potassium appears capable of launching distributed denial-of-service attacks by enlisting compromised machines to flood targets with traffic.

Separate activity attributed to the RondoDoX botnet shows a similar interest in turning exposed application servers into botnet resources.

Organizations should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or apply an approved vendor backport. Restarting affected services and checking active worker processes are important to ensure patched code is actually in use. Bundled runtimes, containers, and appliances require separate verification because updating a host package may not update other embedded copies.

Sophos has released firewall and endpoint intrusion-prevention signatures in addition to detection rules. Keep those protections current, but evaluate alerts against process and network evidence: a single blocked request does not prove whether another request succeeded, and a public exploit demonstration does not guarantee the same code will work against a production system with different settings, dependencies, or worker process behavior.

If immediate patching is not possible, Sophos recommends removing exposed PHP systems from the internet or placing them behind network-level authentication. Teams should monitor for unusual processes, unexpected outbound connections, and suspicious web requests. Temporary configuration changes and firewall signatures can reduce exposure but do not fully remediate both underlying flaws.

Indicators of compromise (IoCs)

Note: IP addresses and domains above are intentionally defanged (for example, using [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.

Action: Update defenses against new malware as it appears and integrate threat intelligence feeds with operational data from your SOCs.