Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware

Public proof-of-concept code for two critical PHP vulnerabilities is now available, and attackers have tried to use the flaws to deploy botnet malware.

Known together as PHP2Shell, CVE-2026-109618 and CVE-2026-109619 both carry a CVSS severity score of 9.2 and can allow attackers to run code without logging in.

However, attempted exploitation must not be confused with a confirmed breach. In its latest correction, issued on October 22 at 21:21 UTC, Sophos said its customer data showed scanning and a small number of failed exploit attempts.

It found no evidence of a successful compromise through these vulnerabilities. Researchers from Sophos identified the intended payload as Potassium, a likely Mirai botnet variant. Security controls blocked the attempt, so the malware was not delivered.

Analysis of the sample nevertheless showed a larger, updated version of the Mirai-derived threat seen earlier in 2026, with download and network disruption features.

The activity follows earlier PHP2Shell targeting before patches became public. Reporting on PHP attacks before patching describes Amazon observations dating to October 17, four days before the fixes.

Those findings underline why defenders should review older logs, while keeping attempted attacks separate from proven code execution on real servers.

Critical PHP2Shell Exploit Code Goes Public

PHP released security updates on October 21. The affected software includes PHP installations serving web requests through PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.

The Dutch National Cyber Security Centre notes that Apache mod_php carries the highest risk because exploitation can occur before application code starts running.

The flaws involve different failures in how PHP handles memory and request data. CVE-2026-109618 can corrupt memory during request cleanup after an out-of-memory condition.

CVE-2026-109619 concerns old request data left in shared internal state, which a later request handled by the same worker can reuse.

These weaknesses can expose more than a single website. Products that bundle PHP, including management interfaces and network appliances, may also need updates from their suppliers.

Administrators should therefore check the runtime used by each service, rather than relying only on the PHP version shown by a command-line check.

Public exploit code does not mean every vulnerable server can be compromised reliably. Sophos said its own research team found working exploitation difficult, even with AI support.

Earlier Cloudflare PHP attack coverage also shows why web application firewall rules are a temporary safeguard, not a replacement for updates.

Potassium Botnet Payload Examined

The blocked traffic included a scanning-related User-Agent, a multipart boundary, and a distinct POST request pattern. Sophos published a temporary file path and an execution command as related indicators.

Since its earlier success claim was withdrawn, those details should not be presented as proof that customer systems ran the payload.

Sample analysis showed that Potassium resolves an encrypted command-and-control address and makes an HTTP request. It checks for a successful HTTP 200 response and verifies that the returned file begins with Linux ELF magic bytes.

That check shows the downloader expects another Linux executable, rather than ordinary web content. The sample also supports hostname lookup and fallback resolution through public DNS services.

Those public services are not malicious indicators by themselves. Like other Mirai-based malware, Potassium can launch distributed denial-of-service attacks, using compromised machines to flood targets with traffic.

Separate RondoDoX botnet exploit activity illustrates similar interest in turning exposed application servers into botnet resources.

Organizations should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or install an approved vendor backport. Restarting affected services and checking the active workers helps ensure the patched code is actually in use.

Bundled runtimes, containers, and appliances need separate checks because updating one host package may leave other copies unchanged.

Sophos has added firewall and endpoint intrusion prevention signatures alongside existing detection rules. Defenders should keep these protections current, but assess alerts against process and network evidence.

A blocked request alone cannot show whether another request succeeded. Equally, a public exploit demonstration does not prove that the same code works against a production system with different settings, dependencies, or worker process behavior.

Where patching cannot happen immediately, Sophos recommends considering removal of exposed PHP systems from the internet or placing them behind network-level authentication.

Teams should monitor unusual processes, unexpected outbound connections, and suspicious web requests. Temporary settings and firewall signatures can reduce exposure, but they do not fully fix both flaws.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware appeared first on Cyber Security News.