Mirai Botnet Operators Join PHP2Shell Attacks
Threat actors linked to Mirai botnet strains have begun targeting the critical PHP2Shell vulnerabilities as security researchers develop and analyze new ASLR bypass exploits.
Radwan AbdulhadiEditor and technology writer
Overview of PHP2Shell Vulnerabilities and Precautionary Outages
Two days after PHP rolled out emergency fixes for the PHP2Shell vulnerabilities, threat actors have tried to use the flaws to spread a Mirai botnet. A security firm has also built an exploit that gets past a key memory protection, and an exposed attacker server has revealed custom tooling. Even so, no successful in-the-wild compromise has been confirmed so far, according to reports.
The threat has prompted many organizations to take systems offline as a precaution. Several government, school and hospital websites in Europe went dark on October 21, and the UK government said 32 of its services were unavailable and four partly unavailable, mostly due to precautionary measures taken while patches were applied.
PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical bugs in the PHP engine that can be exploited for unauthenticated remote code execution. Each has a CVSS v4.0 score of 9.2. Wiz, OpenAI and Calif found the issues in August. PHP patched them on October 21 with versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, one day earlier than planned, after the CVE identifiers leaked online.
Mirai Botnet Operators Target Flaws
Amazon spotted the first exploitation attempt on October 17, and attack activity surged once the fixes went out. Vendors, security firms and government agencies have since issued advisories, detection rules and patching guidance.
Sophos says threat actors have tried to leverage PHP2Shell to install Potassium, which it believes is a variant of the Mirai botnet. The attempt it analyzed was stopped, so the malware never reached the targeted system. Sophos describes the sample as an updated build, with more functionality, of a Mirai-derived strain first identified in early 2026.
Arctic Wolf connected two Potassium binaries to the servers hosting PHP2Shell payloads. However, it said its data does not show the PHP2Shell requests fetching or running the malware. Hunt.io attributed the PHP2Shell traffic it observed to an established Mirai-style botnet, active since at least May 2026, that recently added the flaws to the methods it uses to spread.
Attackers Struggle as Defenses Hold
Sophos believes attackers are having a hard time with the bugs. The lack of successful exploits in the wild suggests threat actors are also struggling. Its own adversary research team has found that building a working exploit is difficult, even with help from AI.
Other firms paint a similar picture. Hunt.io says it has seen exploitation attempts and attackers preparing tooling, but no confirmed compromise, and no vendor has reported one either. Wordfence also says attacks are continuing without any known compromises.
Sansec, which had predicted mass exploitation within 15 minutes of the patch release, has revised that view. In an October 22 update, it said attackers need detailed knowledge of a server and particular conditions on it to succeed, and that the publicly available exploits fail against PHP installations with default settings.
ASLR Bypass and Attacker Tooling Analysis
Researchers have cited address space layout randomization (ASLR), which randomizes where code and data are placed in memory, as a significant hurdle to achieving code execution. VulnCheck says it has found a way around it.
The company's exploit for CVE-2026-109618 relies on a memory leak to reach code execution on x86-64 systems with ASLR enabled and PHP error display turned off, which is the recommended setup for production. The exploit is available to VulnCheck's Initial Access Intelligence customers.
SOCRadar uncovered an attacker pursuing a similar goal. It discovered PHP2Shell tooling on an attacker-controlled server whose working files were left publicly browsable. Companion scripts checked whether real websites had the configuration the exploit requires, though none of the screened sites met the exploit's requirements.
Patching Lags Across Global Instances
Qualys, which analyzed anonymized data from 12,000 of its customers, says only 199,000 PHP instances were patched within 12 hours of disclosure. Roughly 110 million instances run PHP versions 5.4 through 8.1, which are past end of life, and most of them will never receive a vendor patch.
Another 44 million instances run supported PHP branches for which fixes exist but had not been applied. As of the morning of October 23, CISA had not added either vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
Sources
- SecurityWeekMirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
Continue chronologically
Related stories
PHP Warns Admins to Prepare for Two Critical Security Patches
PHP maintainers have issued an urgent warning to web developers and administrators to prepare for the release of two critical emergency patches.
PHP2Shell Leaked Critical Flaws Loom Over Servers
Details on critical PHP2Shell vulnerabilities have leaked online, prompting urgent warnings of potential mass exploitation and fast patch preparation.
Amazon: PHP2Shell Exploitation Began Days Before Patches
Amazon Threat Intelligence reveals that threat actors began targeting critical PHP2Shell vulnerabilities four days before emergency patches were released.
PHP2Shell Exploits Highlight Need to Limit Blast Radius
Following rapid exploitation of PHP2Shell, security experts urge organizations to limit identity reach and blast radius rather than relying solely on patching.
