Two days after PHP launched an emergency solution for PHP2Shell Vulnerability, threat actors tried to exploit the flaw to spread the Mirai botnet. Security companies have also created exploits that protect critical memory, and exposed attack servers have revealed custom tools.
Even so, no successful forest compromise has been confirmed yet.
The threat has prompted many organizations to take systems offline as a precaution. The websites of many governments, schools and hospitals in Europe went dark on October 21, and the British government said that 32 of its services were unavailable and four were unavailable, mostly due to preventive measures taken during the outage.
PHP2Shell is named after CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP engine that can be exploited for unauthenticated remote code execution. Each has a CVSS v4.0 score of 9.2.
Wiz, OpenAI and Calif encountered problems in August. PHP patched them on October 21 with versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, a day earlier than planned, after the CVE identifier was leaked online.
Amazon spotted the first exploit attempt on October 17, and attack activity increased once the fix was out. Since then, vendors, security companies and government agencies have issued guidelines, detection rules and patching guidelines.
Mirai botnet linked to mining efforts
Sophos said the threat actors tried to use PHP2Shell install potassiumwhich is believed to be a variant of the Mirai botnet. Its analysis attempts are stopped, so the malware never reaches the target system.
Sophos describes the sample as an updated, more functional, version of the Mirai-derived strain first identified in early 2026. It can download additional malware and launch DDoS attacks.
Sophos’ latest analysis has corrected earlier updates from the company that reported successful exploits.
Arctic Wolf Connect Two Potassium binaries to the server hosting PHP2Shell payloads. However, it says its data does not show PHP2Shell requests to retrieve data or run malware.
Hunt.io Specific PHP2Shell traffic has been observed with an established Mirai-style botnet, active since at least May 2026, which recently added a flaw to the method it uses to propagate.
Sophos believes that attackers are having a hard time with bugs. “The lack of successful exploitation in the wild indicates that threat actors are still struggling,” it said. Enemy’s own research team has found that building exploits is difficult, even with the help of AI.
Efforts, but no violation confirmed
Other companies paint a similar picture. Hunt.io said it has seen exploit attempts and attackers preparing tools, but there have been no confirmed compromises, and no vendors have reported one. Wordfence also says that the attack is still ongoing without known compromise.
Sansec, which predicted a mass exploit within 15 minutes of the patch’s release, has revised that view. In an update on October 22, it said Attackers need detailed knowledge of the server and the specific conditions on it to succeed, and exploits that are public fail to install PHP with default settings.
Exploit defeats ASLR in production installations
Researchers have cited random address allocation (ASLR), which randomizes where code and data are placed in memory, as a major barrier to achieving code performance. VulnCheck says it has found a way around it.
of the company Exploitation for CVE-2026-109618 Relies on memory leaks to achieve code execution on x86-64 systems with ASLR enabled and PHP error reporting disabled, which is the recommended setup for production. The exploit is available to customers of VulnCheck’s Initial Access Intelligence.
“We are not aware of any other public or commercial exploits that achieve RCE in multiple versions of PHP in production settings, although we expect that to change as adversaries develop more sophisticated attacks,” VulnCheck said.
The company also noted that while hundreds of PoC repositories appear on GitHub, very few of them contain legitimate exploits.
SOCRadar discovers attackers pursuing similar targets. It discovered PHP2Shell tool On a server controlled by an attacker where working files are left publicly accessible.
The file includes an exploit chain for PHP 8.4.26 in Apache mod_php, which the operator has tested in the laboratory and is called a “one-click” exploit. A couple of scripts check that the actual website has the configuration that the crawler needs.
That setting is strange. According to SOCRadar, the chain only works on servers that are set up for testing rather than hard production.
The operator fingerprinted about 20 websites in countries including the United States, England, Canada, France, Finland, Poland and China, and investigated 11 of them in more depth. None of these meet the needs of exploitation.
“The operator demonstrated strong mining development skills, but as of October 22, 2026, we saw no evidence of shell access on any of the audited sites,” SOCRadar said.
Hunt.io also analyzed the server. It found that the operators carried out 10 rounds of attacks, expanding the target list to 123 servers hosted by cloud providers, shared hosting companies and ISPs. About 57 servers running PHP, 10 rejected requests, and none were successfully exploited.
Patching is delayed
Quality, which Analyze Anonymous data from 12,000 customers, says that only 199,000 PHP samples were updated within 12 hours of the release.
According to the company, about 110 million instances, or 71%, run PHP versions 5.4 to 8.1, which are end-of-life, and most of them will not receive a vendor patch. Another 44 million instances run supported PHP branches for existing but unused solutions.
As of the morning of October 23, CISA has not added the vulnerability to its list of known exploits (KEV).
Censys is Monitoring the patching progress for PHP2Shell In real time through a public dashboard that shows how many PHP services on the Internet are still running vulnerable versions.
Related: Third VeloCloud Orchestrator Zero-Day Exploit Attacker in Four Months
Related: Oracle Patches more than 1,200 Vulnerabilities with CPU in October 2026
