Cybersecurity
PHP2Shell attacks try to load Potassium botnet
Researchers and telemetry firms reported widespread PHP2Shell probing and exploit tooling, but said the observed activity had mostly produced scans, failed payloads and no confirmed remote code execution.
- Sophos said attackers had tried to use CVE-2026-109618 and CVE-2026-109619 to install Potassium, a Mirai-derived botnet variant, but the attempts had not succeeded.
- The firm said the malware contacted 134.199.154.64, expected a Linux ELF payload and could carry out denial-of-service attacks; Arctic Wolf said the build included 24 attack commands and disabled Ethereum Name Service resolution.
- SOCRadar said it found PHP2Shell tooling on 206.188.197.105:9999, along with scripts that checked about 20 public websites for exploit prerequisites, and it saw no shell access on the screened sites by 22 October 2026.
- Cloudflare said it saw tens of thousands of attempts within 45 minutes of disclosure and millions within two hours, while Cisco Talos, Previdian and Wordfence said the activity was mostly scanning or failed exploitation.
- The National Cyber Security Centre said it had issued about 50,000 warnings, and VulnCheck's Spencer McIntyre said his team had built a method that chained the two flaws to bypass ASLR on x86-64 systems with PHP's recommended production settings.
Sophos said the newly disclosed PHP2Shell flaws had been used in attempts to load Potassium, a Mirai-derived botnet variant. It said the sample resolved a fixed encrypted command server, connected to 134.199.154.64 and checked for an ELF payload before proceeding.
Arctic Wolf said the botnet build supported 24 commands for floods over ICMP, TCP, UDP and OpenVPN. It also said the code had provision for Ethereum Name Service lookups, but that feature was turned off in the samples it saw.
SOCRadar said it found PHP2Shell exploit code on 206.188.197.105:9999, together with scripts that screened public websites for the version and configuration the exploit needed. It said it had not seen shell access on those targets by 22 October 2026.
Cloudflare said attempts accelerated quickly after disclosure, while Cisco Talos and Previdian said most of what they saw was scanning and uncoordinated payload delivery. Wordfence and other firms also tracked the activity, and the National Cyber Security Centre said it had sent about 50,000 warnings.
VulnCheck's Spencer McIntyre said his team had chained the two flaws to bypass ASLR on x86-64 systems running PHP in its recommended production setup. He said he had not found another public or commercial exploit that achieved the same result.
Named in this story
People
- Spencer McIntyre
- VulnCheck's director of exploit development
Companies
- Sophos
- analysed the sample and linked it to the botnet
- Arctic Wolf
- shared details of the weaponised exploitation attempt
- SOCRadar
- found PHP2Shell tooling on an exposed server
- Cloudflare
- reported the rapid rise in exploit attempts
- Previdian
- recorded exploitation attempts in its telemetry
- Wordfence
- shared IP addresses tied to the exploit attempts
- VulnCheck
- described a technique for chaining the flaws to bypass ASLR
- Censys
- estimated how many PHP hosts and web properties remained exposed
Organisations
- Cisco Talos
- said most observed activity was scanning and basic payload delivery
Governments and agencies
- National Cyber Security Centre
- issued about 50,000 warnings
Products and systems
- PHP
- the runtime whose flaws were being exploited and patched
- Mirai
- the malware family Potassium was derived from
- Potassium
- the Mirai-derived botnet variant under observation
- VirusTotal
- estimated how many hosts ran supported PHP branches
How the source tells it
The piece read as a technical incident report, but it leaned on urgency and risk framing through fast-rising attempt counts, long-tail exposure estimates and repeated notes that exploitation had not yet succeeded.
- urgency rapidly rising attempt counts and time stamps used to stress speed
- threat inflation comparison to Log4Shell and forecasts of a long exposure tail
- reassurance repeated statements that no successful remote code execution had been seen