Hackers Weaponize Public PHP2Shell Exploit Code to Target Universities and Business Websites

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com


Hackers are now using public exploit code to break into websites that run PHP, and universities and business sites are among the main targets.

The bugs behind this wave are two critical flaws in the PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both carry a CVSS v4.0 score of 9.2 and can let an outside user run commands on a server without logging in.

PHP released fixed versions on October 21, 2026, but many servers had not been updated when working exploit scripts spread online almost immediately after the release.

The PHP team says the bugs sit inside the PHP engine itself, so clean website code does not protect a server. The PHP project rates the risk highest for Apache servers that run PHP as a module, known as mod_php, because the bug can be triggered before any site code runs.

Firewalls and web application filters may never see the bad request, which makes patching the main defense. Our earlier report on the public PHP2Shell testing tool explains the research repository that first appeared and what it claimed to test.

Researchers from Akatsuki Legion, an independent adversary research group, identified the malware activity and documented it in a detailed public report.

Their analysis credits the exploit chain to a researcher known as 9bie, and says AI-generated proof-of-concept scripts appeared on GitHub right after the October 21 release.

The group also captured telemetry from its own honeynet and published the tools it found in use, which you can review in the group’s research archive.

Hackers Weaponize Public PHP2Shell Exploit Code

The fastest fix is an upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux vendors received the patches early, so their package channels may already carry them, and the emergency PHP security update details list every affected branch.

Older releases such as PHP 8.1 and earlier no longer get official updates from the PHP project, so those sites need a vendor backport or a move to a supported version.

The public code shows how the bugs chain together. The first flaw, CVE-2026-109618, appears when PHP runs out of memory during an upload, and the cleanup step then works with partly built data.

Flowchart of exploitation (Source - AKATSUKI LEGION)
Flowchart of exploitation (Source – AKATSUKI LEGION)

The second flaw, CVE-2026-109619, leaves old request data in a shared worker, so a later request can reuse it. The public scripts use two memory leaks to learn addresses, then place a fake structure in memory so PHP calls its system function and runs a chosen command.

Activity started before the public release. Amazon Threat Intelligence observed exploit probing starting October 17 and said it came four days before the fixes, while the flaws were still under coordinated disclosure.

That timing matters because some servers may have been probed before their administrators knew the bugs existed. Researchers tracked the spread from several sides.

Hunt.io telemetry recorded three distinct exploit toolkits on October 21, including a mass-exploitation script hosted on one IP address.

Akatsuki Legion also described an open directory that hosts listener scripts logging exploit traffic on ports 80 and 8888. Taken together, the findings show that several groups were sharing and testing the code at the same time.

The botnet link is now clear. Sophos studied a blocked Potassium botnet payload sample that appeared to be a likely Mirai variant.

Its customer data showed scanning and a few failed tries, and Sophos found no proof of a successful compromise. Even so, the sample checks for a Linux program before it runs, which points to a plan to turn exposed servers into DDoS bots.

Exploit as service (Source - AKATSUKI LEGION)
Exploit as service (Source – AKATSUKI LEGION)

Patching remains the only complete fix. PHP’s official security advisory says temporary steps, such as setting session.upload_progress.enabled to 0 and restarting workers, only lower the risk and do not replace an upgrade.

Administrators should also check that PHP-FPM, Apache modules, containers and bundled appliances run the new build, because updating the command-line package alone may leave a live service exposed.

For universities and companies, the lesson is direct. Public exploit code lowers the skill needed to reach a vulnerable server, and the same PHP setup often runs school portals, course sites and small business pages.

Security teams should inventory every PHP runtime, patch it, restart the services, and check logs for POST requests that contain PHP_SESSION_UPLOAD_PROGRESS.

Indicators of compromise (IoCs):-

Type Indicator Context from source
IPv4 206[.]188[.]197[.]105 Mirai variant C2 and mass target list host; also hosts php2shell_mass.py and junare_exploit.py
IPv4 41[.]223[.]30[.]7 Serves history.json tied to exploitation attempts
IPv4 122[.]10[.]130[.]72 Hosts exp_83.php, a PHP serialization payload
IPv4 195[.]245[.]112[.]63 Outdated PHP service on port 8082, flagged High Risk for Keitaro malware
IPv4 85[.]11[.]167[.]243 Open directory showing exploit requests (body text lists 85[.]11[.]163[.]243)
IPv4 124[.]221[.]46[.]164 Open directory hosting i097_listener.py and i097_listener80.py on ports 80 and 8888
Domain thunder[.]godofthunder[.]st Linked to the Potassium Mirai variant targeting Ukrainian networks
User-Agent php2shell-109618 Seen in an exploit request
URI path /lib/phpunit/phpunit/Util/PHP/eval-stdin.php Path in an observed exploit POST request
Form field PHP_SESSION_UPLOAD_PROGRESS Multipart trigger field for the upload-progress flaw
Command id>/out/p1 Example command in the exploit’s execution stage
Proof file /out/p1, /tmp/p1 Files checked to confirm exploit success
Script r935_lfi_find.py LFI discovery scanner
Script probe_rfc1867.py Tests whether upload_progress is enabled
Script race.py Race harness for the upload parsing window
Script php2shell_fp.py Fingerprints PHP targets through a proxy pool
Script rce2.py Session file poisoning through a Kubio LFI
Hash Not published The source lists no MD5, SHA-1 or SHA-256 values

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Weaponize Public PHP2Shell Exploit Code to Target Universities and Business Websites appeared first on Cyber Security News.