PHP2Shell Exploit Attempts Reach Millions — No Confirmed Breaches Yet, but Patching Lags Badly

Millions of attempts to exploit two critical PHP vulnerabilities have been logged since emergency patches shipped on October 21, attackers have tried to rope compromised servers into a Mirai-derived botnet, and a security researcher has built an exploit that defeats a key memory protection in production configurations — yet as of October 23, 2026, not a single confirmed successful compromise has been publicly documented.

The vulnerabilities, collectively nicknamed PHP2Shell, are CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. They allow unauthenticated remote code execution through the PHP interpreter itself — not a plugin or framework sitting on top of it — by crafting HTTP requests that deliberately exhaust server memory and trigger a corrupted shutdown path. Fixes arrived on October 21, a day earlier than planned, after the CVE identifiers surfaced online, covering versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The scale of probing is not in dispute. Attack activity surged after disclosure, with scanning observed within roughly 20 minutes of the patch shipping. Amazon had spotted the first exploitation attempt as early as October 17 — four days before the public fix — though, according to eseospace.com, it remains unclear how that actor obtained exploit information before disclosure.

What has not happened, at least publicly, is a clean break-in. Sophos, Hunt.io, Wordfence, and SOCRadar all report attempts and staged tooling but no confirmed compromise. CISA had not added either CVE to its Known Exploited Vulnerabilities catalog as of 18:01 UTC on October 23, according to eseospace.com.

The lack of successful exploits in the wild suggests threat actors are also struggling.— Sophos

The main reason exploitation is hard is address space layout randomization (ASLR), which randomizes where code and data sit in memory each time a program runs, making it difficult for an attacker to predict where to aim. Reaching memory corruption — which the PHP2Shell bugs enable — is not the same as achieving code execution, and that gap has so far held. Having initially forecast mass exploitation within 15 minutes of patch release, Sansec walked back that view on October 22, concluding that attackers require detailed knowledge of a specific server and that publicly available exploits break down against PHP installations running default settings.

That picture shifted somewhat when VulnCheck disclosed it had built an exploit for CVE-2026-109618 that uses a memory leak to bypass ASLR and reach code execution on x86-64 systems with error display turned off — the recommended production configuration. The company said it is not aware of any other public or commercial exploit that achieves remote code execution across multiple PHP versions in production setups, though it expects that to change.

We are not aware of any other public or commercial exploit that achieves RCE on multiple versions of PHP in production configurations, though we expect that to change as adversaries develop incrementally more sophisticated attacks.— VulnCheck

The VulnCheck exploit is available only to its paying customers. VulnCheck also noted that while hundreds of proof-of-concept repositories have appeared on GitHub, very few contain legitimate exploits. Separately, eseospace.com cited watchTowr as saying the exploits being sprayed indiscriminately "either don't work at all, test for timing-based differences, or crash the target."

Sophos linked much of the attack traffic to a botnet variant it calls Potassium, which it believes is a Mirai derivative first identified in early 2026. The attempt Sophos analyzed was stopped before the malware reached its target. Sophos also corrected an earlier update in which it had reported a successful exploitation — that report was wrong, the company said. The Potassium sample Sophos examined can download additional malware and launch distributed denial-of-service attacks. It resolves a hard-coded, encrypted command-and-control address, establishes a TCP connection, and checks that the follow-on payload is a Linux ELF binary, according to scyscan.com.

According to scyscan.com, Nokia Deepfield researchers described Potassium as a Mirai fork whose static configuration table is encrypted with ChaCha20 — marking the first known use of that algorithm in a Mirai variant — and which also employs a single static byte for wire traffic alongside a DNS misdirection scheme that swaps the two 16-bit halves of every resolved address before connecting. Arctic Wolf said the botnet supports 24 commands for flood attacks over ICMP, TCP, UDP and OpenVPN, and that both ARM and x86 builds contain configuration for resolving command-and-control infrastructure through the Ethereum Name Service, though that capability was disabled in the samples it examined.

According to Hunt.io, the PHP2Shell traffic it observed stems from an established Mirai-style botnet that has been operating since at least May 2026 and recently incorporated the new flaws into its propagation methods. Arctic Wolf connected two Potassium binaries to servers hosting PHP2Shell payloads but said its data does not show the PHP2Shell requests actually fetching or running the malware.

An attacker's own server provided an unusually detailed look at the state of exploit development. SOCRadar found PHP2Shell tooling on an exposed, publicly browsable attacker-controlled server at 206.188.197[.]105:9999. The operator labeled the central file, aslr_exploit.py, a Python-based 'one-click' PHP2Shell exploit targeting PHP 8.4.26 running under Apache mod_php. Scyscan.com reported that the script operates in three stages: recycling the target's PHP worker, leaking memory addresses via the session cookie to circumvent ASLR, and then exploiting PHP's session upload progress handling to execute a shell command. Additional scripts were used to check whether live websites met the specific configuration the exploit demands.

The operator shows strong exploit development skills, but as of October 22, 2026, we have seen no evidence of shell access on any screened site.— SOCRadar

The configuration the exploit needs is uncommon — more like a test system than a hardened production server, according to SOCRadar. Across the US, UK, Canada, France, Finland, Poland and China, the operator fingerprinted roughly 20 websites and subjected 11 of them to deeper probing. None met the requirements. In Hunt.io's review of the same server, the operator was found to have conducted 10 attack rounds, broadening the target list to 123 servers spanning cloud providers, shared hosting companies and ISPs. Roughly 57 ran PHP, 10 rejected the requests outright, and none was successfully exploited.

The practical threat is compounded by how slowly patching is moving. Drawing on anonymized data from 12,000 customers, Qualys found that just 199,000 PHP instances had been patched within 12 hours of disclosure. A further 44 million run supported branches for which patches exist but had not been applied as of the period covered by Qualys's data.

Hunt.io's own internet-wide scan as of October 22 found approximately 3.19 million unique IP addresses exposing PHP signals, with end-of-life 7.x, 5.x and 4.x branches accounting for roughly 1.1 million of those IPs. The real footprint is larger still, because hosts with version reporting disabled and no other PHP indicators never appear in such scans.

The disruption has already been felt beyond servers. On October 21, government, school and hospital websites across Europe went dark, with the UK government reporting that 32 of its services were fully unavailable and four were partly unavailable — a situation securityweek.com attributed largely to operators pulling systems offline as a precaution during patching. At the peak, Oh Dear's uptime monitoring showed 18.8% of the sites it tracks had gone offline, against 0.9% the previous week, according to hunt.io.

Experts are divided on how exploitable the flaws are in practice. Calif, one of the research teams that found the bugs, says they are "always exploitable under default configurations," and Datadog says PHP's default memory limits are vulnerable. Red Hat takes a different view, saying remote code execution on its standard PHP-FPM setups "is difficult in practice and typically requires non-default behavior," while Fastly adds that existing exploits depend on knowing the exact PHP build. Beazley notes that "no single exploit works across all PHP versions and configurations." PHP itself considers the risk highest for Apache with mod_php. Every source agrees on one point: patch.

In its October 21 alert, CISA directed organizations to patch immediately, with internet-facing systems first in line, and stated that those unable to update — or running PHP 8.1 or older — should take PHP-based systems offline until patching or upgrading is possible. Amazon advises organizations to investigate any observations involving the IP addresses it published rather than simply blocking them, because those addresses include shared anonymization infrastructure. According to Bitdefender, a successful exploit may return HTTP 200 while leaving the worker running, which means crash logs reflect attempts rather than confirmed compromises — and an error log that looks clean is no guarantee that a system has not been breached.

Why it matters — With over 150 million PHP instances still unpatched — most of them permanently beyond vendor support — and attackers actively refining exploits that can now bypass production memory protections, the window between 'no confirmed breach' and widespread compromise is narrowing.

Sources differ on Whether PHP2Shell is exploitable under default configurations: Flaws are 'always exploitable under default configurations'; PHP's default memory limits are vulnerable. (eseospace.com (citing Calif and Datadog)) vs Remote code execution on standard PHP-FPM setups 'is difficult in practice and typically requires non-default behavior'; existing exploits need knowledge of the exact PHP build; 'no single exploit works across all PHP versions and configurations.' (eseospace.com (citing Red Hat, Fastly, Beazley))

Reported by wikipedia.org, en.wikipedia.org, securityweek.com, scyscan.com, hunt.io, eseospace.com