A wave of attack attempts is targeting recently patched PHP vulnerabilities, as threat actors try to exploit them to deploy a Mirai-derived botnet known as “Potassium.” Vulnerabilities CVE-2026-109618 and CVE-2026-109619—both rated with a critical 9.2 severity score—allow unauthenticated remote code execution via specific HTTP requests. PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have released fixes.
Analysis of the malware shows it appeals not just to load malicious payloads but also to disrupt networks. Among its capabilities are downloading components, hijacking traffic for volumetric flooding attacks, and hard-coded mechanisms to establish communication with its command-and-control (C2) infrastructure. The sample resolves a C2 address to IP 134.199.154[.]64 and expects follow-on payloads in ELF binary format after verifying a successful HTTP response.
How the Attack Chain Works
Potassium connects to its C2 via a loader served from a small number of source IPs (e.g. 85.11.167[.]243; 217.60.242[.]76; 45.198.224[.]169). After worming its way in, the malware issues a DNS query for thunder.godofthunder[.]st, resolves it to that same C2 IP, and uses TCP port 50792. It’s capable of launching DDoS attacks over ICMP, TCP, UDP, and OpenVPN. While builds exist for both ARM and x86, an address resolution feature via the Ethereum Name Service (ENS) remains present but currently inactive.
Exploit Attempts Up, But No Confirmed RCE Yet
Despite widespread scanning and attempts, no confirmed remote code execution (RCE) has been observed. After the vulnerabilities became public, tens of thousands of scans began, escalating to millions by October 22, 2026. Meanwhile, honeypots have recorded many probes aiming to exploit memory leaks, bypass ASLR protections, probe session upload settings, or drop web shells—but none have succeeded so far.
Key to this struggle is PHP’s ASLR (Address Space Layout Randomization), a defense meant to make memory-based exploits unpredictable. A novel exploit technique chains the two CVEs together, leaking memory to bypass ASLR and achieve RCE on x86-64 setups—even with PHP configured in its recommended secure mode. Yet despite this, as of October 22, no vulnerable sites that have been probed have allowed full exploit execution.
The exposed tooling used by attackers includes a “one-click” exploit labeled asl_exploit.py for Apache + PHP 8.4.26, plus screening scripts like php2shell_fp.py, deep_probe.py, and wp_attack.py, which scan for PHP version, server configuration, WordPress proxies, and more. These tools are being hosted on multiple IPs, with evidence of targeting across Canada, China, Europe, the U.K., and the U.S.
Assessments from major cybersecurity firms estimate that over 3 million hosts, and more than 34 million web properties, remain vulnerable as of October 23. The issue is not confined to specific applications—because the vulnerable code resides in the PHP engine itself, any site running affected versions, even with clean application codebases, could be at risk. Older PHP versions without patches may continue to fuel catch-up for months.
Governments, schools, hospitals, and other service providers have taken preemptive steps, taking systems offline or issuing warnings. In the U.K., dozens of digital services were shut down or partially disabled while updates were applied. Thousands of alert notices have been sent to organizations, emphasizing urgency.
What to Do Right Now: Site owners running PHP 8.2 through 8.5 should update to patched versions immediately. Review server-side session settings, check for outdated WordPress or other CMS components, disable risky session upload configuration, and monitor for signs of web shell creation or unexpected outbound traffic. Employ network defenses to block known malicious IPs and DNS domains associated with the exploit.
Final analysis: Although Potassium’s creators have poured serious effort into amplifying the impact of PHP2Shell vulnerabilities—including bypasses for ASLR and extensive scanning tools—the lack of confirmed remote code execution at scale suggests widespread mitigation efforts are buying time. Still, the sheer number of vulnerable hosts means this could become a long-lived threat. Watch whether the ENS resolution feature becomes activated and whether future variants can more reliably cross the hardened security measures. Attackers might still close the gap.
