Attackers are exploiting publicly released proof-of-concept code to breach websites running PHP, with university and business sites among the primary targets.
The vulnerabilities at the center of this campaign are two critical flaws in the PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively nicknamed “PHP2Shell.” Both are scored 9.2 on the CVSS v4.0 scale and can allow a remote, unauthenticated actor to execute commands on a server.
PHP published patched releases on October 21, 2026, but many servers remained unpatched when exploit scripts began appearing publicly almost immediately after the fixes were issued.
The PHP project says the defects lie inside the PHP engine itself, so even well-written website code does not prevent exploitation. The project warns that Apache servers using PHP as a module (mod_php) are at greatest risk because the vulnerability can be triggered before any site code runs.
Because malicious requests can bypass some firewalls and web-application filters, patching is the primary defense. An earlier report on the publicly released PHP2Shell testing tool describes the research repository that first appeared and what it claimed to test.
Independent researchers from Akatsuki Legion identified active malware campaigns exploiting these flaws and published a detailed public analysis.
Their report credits the exploit chain to a researcher known as “9bie” and notes that AI-generated proof-of-concept scripts appeared on GitHub immediately after the October 21 release.
Akatsuki Legion also collected telemetry from its honeynet and released the tools they observed in use; those artifacts are available in the group’s research archive.
Hackers weaponize public PHP2Shell exploit code
The quickest remediation is to upgrade to one of the patched PHP builds: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributors received the fixes early, so vendor package repositories may already contain updated packages. The PHP emergency security announcement lists the affected branches and the available fixes.
Older PHP branches such as 8.1 and earlier are no longer supported by the PHP project; sites running those releases will need a vendor backport or must upgrade to a supported version.
The public exploit code shows how the two bugs chain together. CVE-2026-109618 manifests when PHP runs out of memory during an upload; the subsequent cleanup step then operates on partially constructed data.
The second vulnerability, CVE-2026-109619, leaves stale request data in a shared worker, allowing a later request to reuse it. Public scripts exploit two memory leaks to discover target addresses, then craft a fake memory structure so PHP invokes its system function and executes an attacker-supplied command.
Some malicious probing began before the public patch release. Amazon Threat Intelligence observed exploit scanning starting October 17, four days prior to the fixes while the vulnerabilities were still under coordinated disclosure. That timing means some servers may have been probed before administrators were aware of the flaws.
Multiple telemetry sources documented the rapid spread. Hunt.io recorded three distinct exploit toolkits on October 21, including a mass-exploitation script hosted on a single IP address.
Botnet link
Akatsuki Legion also described an open directory hosting listener scripts that log exploit traffic on ports 80 and 8888. Overall, the findings indicate several groups were sharing, testing and adapting exploit code concurrently.
Analysis by Sophos identified a blocked Potassium botnet payload sample that appears to be a Mirai-style variant. Customer telemetry showed scanning activity and a few failed attempts, with no confirmed successful compromise observed by Sophos. The sample checks for the presence of a Linux binary before executing, suggesting an intent to recruit compromised servers into a DDoS botnet.
Patching remains the only complete mitigation. PHP’s official advisory notes that temporary measures—such as setting session.upload_progress.enabled to 0 and restarting workers—only reduce risk and do not substitute for an upgrade.
Administrators should ensure that PHP-FPM instances, Apache modules, containers and bundled appliances are running the updated builds, because updating only the command-line package may leave a running service exposed.
For universities and businesses the guidance is straightforward: public exploit code lowers the skill threshold required to attack a vulnerable server, and many campus portals, course sites and small business pages use the same PHP configurations. Security teams should inventory every PHP runtime, apply patches, restart services, and search logs for POST requests containing PHP_SESSION_UPLOAD_PROGRESS.
Indicators of compromise (IoCs):
| Type | Indicator | Context from source |
|---|---|---|
| IPv4 | 206[.]188[.]197[.]105 | Mirai variant C2 and mass target list host; also hosts php2shell_mass.py and junare_exploit.py |
| IPv4 | 41[.]223[.]30[.]7 | Serves history.json tied to exploitation attempts |
| IPv4 | 122[.]10[.]130[.]72 | Hosts exp_83.php, a PHP serialization payload |
| IPv4 | 195[.]245[.]112[.]63 | Outdated PHP service on port 8082, flagged High Risk for Keitaro malware |
| IPv4 | 85[.]11[.]167[.]243 | Open directory showing exploit requests (body text lists 85[.]11[.]163[.]243) |
| IPv4 | 124[.]221[.]46[.]164 | Open directory hosting i097_listener.py and i097_listener80.py on ports 80 and 8888 |
| Domain | thunder[.]godofthunder[.]st | Linked to the Potassium Mirai variant targeting Ukrainian networks |
| User-Agent | php2shell-109618 | Seen in an exploit request |
| URI path | /lib/phpunit/phpunit/Util/PHP/eval-stdin.php | Path in an observed exploit POST request |
| Form field | PHP_SESSION_UPLOAD_PROGRESS | Multipart trigger field for the upload-progress flaw |
| Command | id>/out/p1 | Example command in the exploit’s execution stage |
| Proof file | /out/p1, /tmp/p1 | Files checked to confirm exploit success |
| Script | r935_lfi_find.py | LFI discovery scanner |
| Script | probe_rfc1867.py | Tests whether upload_progress is enabled |
| Script | race.py | Race harness for the upload parsing window |
| Script | php2shell_fp.py | Fingerprints PHP targets through a proxy pool |
| Script | rce2.py | Session file poisoning through a Kubio LFI |
| Hash | Not published | The source lists no MD5, SHA-1 or SHA-256 values |
Note: IP addresses and domains are intentionally defanged (for example, [.] in place of .) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.
Give your SOC the alert context to stop incidents quickly. Integrate Threat Intel from 16K SOCs.
