PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware: What PHP Site Owners Must Patch Now

Attackers are hammering a pair of critical PHP bugs with millions of exploit attempts, and some of them want to turn vulnerable web servers into Mirai botnet nodes. The good news: nobody has confirmed a successful break-in yet. The bad news: that could change fast, and tens of millions of servers still run vulnerable code.

PHP2Shell Explained: CVE-2026-109618 and CVE-2026-109619

PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619. Both flaws sit inside the PHP engine itself, not in any plugin or app built on top of it. Each carries a CVSS v4.0 score of 9.2, and either one lets an attacker run code on a server with a crafted HTTP request, no login required.

The vulnerable code goes back to PHP 5.4, released in 2012. That means a plain WordPress, Drupal, or Joomla site with perfectly clean code still carries the risk if the underlying PHP version is vulnerable. Analysts already compare the situation to Log4Shell because of the sheer number of affected systems.

Researchers at Wiz, OpenAI, and Calif found the bugs in August. The PHP team shipped emergency fixes on October 21, one day ahead of schedule, after the CVE identifiers leaked online.

Which PHP Versions Fix PHP2Shell (and Which Get No Patch)

Update to one of these releases:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

PHP 7.4, 8.0, and 8.1 will not get official fixes. If you run those, switch to a supported branch or ask your Linux distribution or host for a backported patch.

Cloudflare Logs Millions of PHP2Shell Exploit Attempts in Hours

Cloudflare saw thousands of exploit attempts in the ten hours before the public announcement. Within 45 minutes of disclosure, that jumped to tens of thousands. Two hours in, it hit hundreds of thousands, and by October 22 the count reached millions. Cloudflare had switched on a protective firewall rule for every customer, free plans included, about nine hours before disclosure, though it stresses the rule is a stopgap and not a replacement for patching.

Most of this traffic is noisy scanning and fingerprinting. Honeypot operators also report attackers trying to confirm command execution, steal secrets from environment variables, plant persistent access, and fetch a second-stage payload.

Potassium: The Mirai Botnet Attackers Tried to Install

Sophos stopped one attempt that tried to install a botnet called Potassium, which it describes as an expanded version of a Mirai-based strain first seen in early 2026. Because Sophos blocked the request, the malware never reached its target. The company also corrected an earlier update that wrongly described a successful compromise.

Analysis of the sample shows how the malware behaves:

• It decrypts a hard-coded command-and-control address and opens a TCP connection.
• It checks for an HTTP 200 reply, then confirms the download starts with the ELF header, which tells it a Linux binary is coming.
• If normal name lookup fails, it falls back to public DNS servers such as 8.8.8.8 and 1.1.1.1.
• It can launch DDoS floods, and Arctic Wolf counted 24 attack commands covering ICMP, TCP, UDP, and OpenVPN traffic.
• Both ARM and x86 builds carry Ethereum Name Service settings for finding C2 servers. The feature is switched off for now, but a future version could use it to make takedowns harder.

In the sandbox run, the botnet aimed floods at two neighboring hosts inside one Ukrainian network. Arctic Wolf noted that it could tie the malware to the payload servers but could not show the PHP2Shell requests actually fetching or running it. Hunt.io, meanwhile, links the traffic to an established Mirai-style botnet active since at least May 2026 that simply added these PHP bugs to its toolbox.

Why No PHP2Shell Attack Has Succeeded Yet

Several security teams report the same thing: exploitation is hard. Sophos says its own research team struggled to build a working exploit, even with AI help. Sansec first predicted mass compromise within 15 minutes of the patch, then backed off. Its October 22 update says attackers need detailed knowledge of the target and specific server conditions, and that public exploits fail against PHP setups with default settings.

Leaked Attacker Server Shows the Exploit Needs a Lab-Like Setup

An exposed attacker server shows the same struggle. SOCRadar found a "one-click" exploit for PHP 8.4.26 on Apache mod_php sitting in a publicly browsable directory. The chain restarts a PHP worker, leaks memory addresses through the session cookie to defeat ASLR, then abuses the session upload progress feature to run a shell command. It only works on servers configured more like lab machines than hardened production hosts. The operator profiled about 20 sites and probed 11 closely, and none qualified. Hunt.io says the same operator ran ten attack rounds against 123 servers. About 57 ran PHP, ten rejected the requests outright, and none fell.

The toolkit also contained WordPress enumeration scripts and signs of crypto and Web3 targeting, which suggests a financially motivated crew.

VulnCheck Exploit Bypasses ASLR on Production PHP Servers

ASLR randomizes where code sits in memory, and it has been the main obstacle for attackers. VulnCheck says it built an exploit that chains both bugs, uses a memory leak to beat ASLR, and reaches code execution on x86-64 systems with PHP's recommended production error settings. VulnCheck shares it only with paying customers, and says it knows of no other public or commercial exploit that works across several PHP versions in production setups.

VulnCheck also points out that hundreds of proof-of-concept repositories on GitHub contain very little real exploit code. Still, the company expects adversaries to improve quickly. Cisco Talos agrees: basic scanning with public code takes little effort, and skilled groups may be building custom tooling right now.

34 Million PHP Servers Are Still Vulnerable

Censys counted more than 34.4 million PHP services still running vulnerable versions as of October 23. Qualys, using data from 12,000 customers, found only 199,000 PHP instances patched within the first 12 hours. It also estimates roughly 110 million instances, about 71%, run end-of-life versions from 5.4 through 8.1, and most of those will never get a vendor fix. Another 44 million run supported branches with fixes available but not installed.

Fear of the bugs has already disrupted real services. Government, school, and hospital sites in Europe went offline on October 21. The UK government reported 32 services unavailable and four partly unavailable, and its cyber agency sent roughly 50,000 warnings to organizations. In Japan, Mitsubishi UFJ Financial Group paused some internet services, and the Finance Ministry halted some site content. As of the morning of October 23, CISA had not added either flaw to its Known Exploited Vulnerabilities catalog.

How to Protect Your PHP Server Today

1. Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 right away, or move off unsupported versions.
2. Ask your hosting provider whether it has patched your servers, since shared hosting depends on them.
3. Keep a WAF or CDN rule active as temporary cover, but do not treat it as a fix.
4. Restrict outbound connections from web servers, because Mirai-style malware needs to call home.
5. Disable risky PHP functions such as exec, shell_exec, system, and passthru if your site does not need them.
6. Watch for web server processes that spawn shells, run wget or curl, or execute files from /tmp and /dev/shm.

Low success rates today describe the current exploit code, not the bugs. Patch before a reliable exploit shows up.

Frequently Asked Questions

Related Reading

• New Linux Botnet SSHStalker Uses Old-School IRC to Hijack Nearly 7,000 Servers
• Rank Math PRO Malware: How to Check, Clean and Secure Your WordPress Site (CVE-2026-111862)
• Megalodon GitHub Malware Infects 5,500+ Repositories via Fake CI/CD Commits
• Tsundere Bot Ransomware Attacks: TA584 Shifts to New Malware Delivery Tactics
• DynoWiper Malware Linked to Sandworm in Failed Cyberattack on Poland's Power Grid