Public proof-of-concept code for two critical PHP vulnerabilities—collectively dubbed PHP2Shell—has been released, and security teams have observed scanning and failed attempts to use the flaws to deliver botnet malware. While attempted exploitation is concerning, researchers stress that scans and blocked deliveries are not the same as confirmed successful compromises. The key takeaways are straightforward: review runtime configurations, apply the issued PHP fixes, and treat detection telemetry carefully so you don’t mistake noise for a breach.
What happened
Researchers and vendors published fixes for CVE-2026-109618 and CVE-2026-109619 after proof-of-concept exploit code became available. Both flaws have a CVSS score of 9.2 and can allow remote code execution without authentication in certain configurations. After the code surfaced, Sophos observed scanning activity and a small number of failed exploit attempts; their telemetry showed no confirmed customer compromises. The intended payload in at least some of the attempts was identified as “Potassium,” a likely Mirai-derived botnet variant. Security controls blocked the malware delivery in the cases Sophos studied.
Why exploitation is tricky
Public exploit code does not automatically translate to reliable mass exploitation in the wild. Sophos analysts noted that getting a working exploit was difficult even with AI-assisted help. The vulnerabilities arise from distinct failures in how PHP handles memory and request data: one corrupts memory during request cleanup after an out-of-memory event (CVE-2026-109618), while the other lets stale request data persist in shared internal state and be reused by later requests on the same worker (CVE-2026-109619). Those differences mean success depends heavily on the server runtime, process worker behavior, and deployment specifics—so many servers may not be exploitable with the published PoC.
The Potassium payload and its behavior
Analysis of the blocked payloads shows Potassium behaving like a Mirai-family downloader. The samples resolve an encrypted command-and-control address, fetch a payload, and check that the response begins with ELF magic bytes—indicating the downloader expects a Linux binary. The binary supports hostname lookup and fallback DNS resolution, and includes features for downloading additional components and launching network disruption (DDoS) activity. Sophos also reported distinctive scan markers such as a scanning User-Agent string, a multipart boundary string, and a repeated POST request pattern.
Who and what to check
Not all PHP installations are the same. A key point for defenders: check the runtime used by each exposed service. The affected code paths can appear in PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Apache mod_php is especially risky since exploitation can happen before application code runs. Products that bundle PHP—management interfaces, network appliances, containers, or bespoke runtime images—may not show the vulnerable version with a simple system-level PHP version command. Inventory every runtime copy, container image, and appliance package to be sure.
Mitigation and detection steps
- Patch: Install the official fixes or vendor-approved backports as soon as possible. The PHP releases to target are 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- Restart and verify: Restart affected services after patching and verify active worker processes are running the patched code. A reboot alone does not guarantee every worker or container is updated.
- Check bundled runtimes: Update each instance of PHP bundled in products or container images; one updated host does not fix other copies.
- Temporary containment: If you cannot patch immediately, consider removing exposed PHP services from the internet or placing them behind network-level authentication.
- Detections and signatures: Keep firewall, WAF, and intrusion prevention signatures current. Treat alerts as investigatory leads, not proof of compromise—correlate to process and network evidence before declaring a breach.
- Hunting suggestions: Review older logs for scanning and unusual POST request patterns; monitor for unexpected outbound connections, new or unusual processes, and files dropped into temporary directories. Sophos also published a sample payload path and execution command that can assist in hunting.
Indicators of compromise (IoCs):-
| Type | Indicator | Source context |
|---|---|---|
| Source IP | 45[.]198[.]224[.]169 | PHP2Shell exploit attempt |
| Payload-hosting IP | 92[.]118[.]112[.]100 | Related payload infrastructure |
| Payload URL | hxxp://92[.]118[.]112[.]100/nfs | Related malware download location |
| Command-and-control IP | 134[.]199[.]154[.]64 | Potassium C2 server |
| Command-and-control IP | 117[.]55[.]202[.]115 | Potassium C2 server |
| Domain | thunder[.]godofthunder[.]st | Contacted during sandbox analysis |
| Domain | hackattackkaboom[.]botlesscucks[.]st | Related malware staging server |
| Domain | hik[.]gettingheadfromduckysmom[.]st | Potassium infrastructure embedded in payload |
| MD5 | b61a098fc62a2c2696e196dca78da71a | Related likely Mirai-variant sample |
| SHA-1 | c472dab4ff7c16782a8037f988d4daa6d4bdb343 | Related likely Mirai-variant sample |
| SHA-256 | 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 | Related likely Mirai-variant sample |
| File path | /tmp/nfs | Published payload-path indicator |
| Command | ./nfs php | Published payload-execution indicator |
| User-Agent | php2shell-scan/109618 | Observed exploit traffic |
| Multipart boundary | B7kQpoc618 | Observed exploit-request string |
Practical guidance for teams
- Prioritize patching exposed public-facing PHP runtimes and appliance images.
- Use detection telemetry to guide hunting, but demand corroborating evidence (process creation, file artifacts, unusual outbound connections) before declaring a compromise.
- Treat WAF and firewall adjustments as stopgaps; they reduce exposure but do not repair the underlying memory and request-handling flaws.
- Coordinate with vendors for bundled products and appliances to ensure they issue and apply backports.
- Keep your SOC and incident responders informed about the distinct CVE behaviors so they can tune monitoring and triage properly.
This disclosure is a reminder that public exploit code raises urgency but does not always equal active, successful exploitation across diverse environments. Patch, verify, and hunt smartly—then treat detections as leads, not verdicts.
Licensed under CC BY-ND 4.0 International
