PHP2Shell Vulnerabilities Trigger Millions of Exploit Attempts as Hackers Target Web Servers With Mirai Malware

Cybersecurity researchers have detected millions of exploitation attempts targeting two critical PHP vulnerabilities collectively known as PHP2Shell. Attackers are attempting to exploit the flaws to deploy malware, steal sensitive information and recruit vulnerable servers into botnets.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, carry CVSS scores of 9.2 and could allow unauthenticated remote code execution (RCE) under vulnerable configurations.

Despite widespread scanning and exploitation attempts, researchers have not confirmed successful real-world exploitation in the activity examined.

What Are the PHP2Shell Vulnerabilities?

PHP2Shell refers to two critical vulnerabilities affecting the PHP runtime itself rather than individual web applications.

The flaws could potentially allow attackers to execute commands on vulnerable web servers using specially crafted HTTP requests.

The vulnerabilities affect multiple PHP deployment configurations, with Apache mod_php presenting particularly significant exploitation risks.

Because the flaws exist in the PHP engine, applications such as WordPress, Drupal and Joomla may be exposed even when their application code contains no known vulnerabilities.

Millions of Exploitation Attempts Detected

Cloudflare reported observing tens of thousands of exploitation attempts within 45 minutes of the vulnerabilities becoming public.

That activity increased to hundreds of thousands of attempts within two hours and reached millions by October 22, 2026.

Security researchers observed attackers attempting to:

• Identify vulnerable PHP installations
• Execute unauthorized system commands
• Retrieve sensitive environment variables
• Install PHP web shells
• Download additional malicious payloads
• Establish persistent access to compromised systems

However, researchers emphasized that most observed activity involved automated scanning and unsuccessful exploitation attempts.

Attackers Attempt to Deploy Potassium Mirai Botnet

Sophos identified attempts to exploit PHP2Shell vulnerabilities to distribute Potassium, a malware variant derived from the Mirai botnet.

The malware is designed to communicate with attacker-controlled infrastructure and download additional Linux executable payloads.

Researchers found that Potassium could support distributed denial-of-service (DDoS) attacks against targeted systems.

The identified malware infrastructure included:

• 92.118.112[.]100 — Malware loader infrastructure
• 134.199.154[.]64 — Command-and-control infrastructure
• TCP port 50792 — Observed communication channel

These indicators should be used for threat hunting and investigation rather than treated as proof of compromise on their own.

Attackers Develop Advanced Exploitation Tools

SOCRadar identified PHP2Shell exploitation tools hosted on an attacker-controlled server.

The tools were designed to identify vulnerable PHP environments and attempt to bypass Address Space Layout Randomization (ASLR), a security mechanism that makes memory exploitation more difficult.

Separately, VulnCheck researchers developed an exploit capable of achieving remote code execution on ASLR-enabled x86-64 systems under tested production configurations.

This demonstrates that although widespread attacks have largely been unsuccessful, more sophisticated exploitation techniques could increase the threat.

Millions of PHP Services Potentially Exposed

According to Censys, more than 34.4 million PHP services were assessed as vulnerable as of October 23, 2026.

The vulnerabilities affect PHP engine code dating back to PHP 5.4, creating significant exposure among organizations running outdated software.

Some government, education and healthcare services were temporarily taken offline as a precaution while security updates were applied.

The United Kingdom's National Cyber Security Centre also issued approximately 50,000 warnings to organizations.

PHP Security Updates Available

The PHP development team released emergency security updates addressing both vulnerabilities.

Organizations should upgrade immediately to a fixed version or later supported release.

Systems running unsupported PHP versions should migrate to supported branches or obtain appropriate security backports from their operating-system vendors.

Security Recommendations

Organizations should prioritize the following measures:

• Apply security patches: Upgrade affected PHP installations immediately.
• Identify exposed services: Review internet-facing PHP servers and hosting environments.
• Monitor web traffic: Investigate suspicious HTTP requests associated with PHP2Shell exploitation.
• Review endpoint activity: Detect unauthorized command execution and unexpected PHP processes.
• Monitor outbound connections: Investigate communications with suspicious malware infrastructure.
• Protect sensitive credentials: Review access to API keys, database credentials and environment variables.
• Strengthen web security: Use web application firewalls and network restrictions as additional defensive layers.

Security Takeaway

The PHP2Shell vulnerabilities demonstrate how flaws in widely deployed software runtimes can create significant risks across millions of websites.

Although security researchers have observed millions of exploitation attempts, the reported campaigns have not yet established widespread successful compromise.

Organizations should not interpret unsuccessful early attacks as evidence that the vulnerabilities are harmless. As exploitation techniques improve, unpatched PHP servers could become attractive targets for botnet operators and other cybercriminal groups.