Threat actors' attempts to weaponize PHP2Shell vulnerabilities fall short as researchers reveal ASLR bypass

Threat actors have been scanning and probing web servers for the recently disclosed PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) in an effort to deploy a Mirai-derived botnet variant known as Potassium. The vulnerabilities, rated 9.2 by CVSS, allow unauthenticated remote code execution but have been patched in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

"However, analysis of the sample revealed that it is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026," Sophos said. "The sample displays downloader and network disruption functionality."

The Potassium sample contacts a hard-coded, encrypted command-and-control address (134.199.154[.]64) over TCP, checks for an HTTP 200 response, and expects a Linux ELF binary as a second-stage payload. It includes a resolver that can use public DNS servers such as 8.8.8.8, 1.1.1.1 and 1.0.0.1, and can launch DDoS attacks similar to historic Mirai activity.

Three IP addresses (85.11.167[.]243, 217.60.242[.]76, 45.198.224[.]169) have been linked to the campaign, contacting a loader at 92.118.112[.]100. The botnet attempts to flood two adjacent hosts in a Ukrainian network (45.88.138[.]0 and 45.88.138[.]44) using volumetric attacks.

Security firms reported that, despite the high volume of scanning—tens of thousands of attempts within minutes of public disclosure and millions by late October 2026—no successful exploitation has been observed. Cisco Talos described most activity as scanning or basic payload delivery, while Previdian recorded hundreds of attempts but no confirmed remote code execution.

"We've seen plenty of PHP2Shell probes and exploitation attempts in our honeypots," Previdian said. "At the time of writing, we've observed no successful remote code execution and no dropped PHP files. Reliable RCE may be harder to achieve than initially expected."

SOCRadar identified a Python exploit tool (aslr_exploit.py) that claims to provide a "one-click" PHP2Shell exploit for PHP 8.4.26, leveraging a memory leak via session cookies to bypass ASLR and abusing session upload progress to execute commands. The toolset also includes scripts for fingerprinting target sites and enumerating WordPress plugins, though no compromised sites were confirmed as of October 22, 2026.

VulnCheck demonstrated a novel technique that chains two vulnerabilities to bypass ASLR on x86-64 systems, achieving remote code execution even with PHP's recommended production error-display settings. The researchers warned that successful exploitation could give attackers footholds to access API keys, databases and other internal services.

Government and public sector sites in Asia, Europe and North America have taken precautionary shutdowns, with the U.K. reporting 32 digital services offline. The National Cyber Security Centre has issued roughly 50,000 warnings. Analysts estimate that over 34 million PHP services remain vulnerable, and many organizations may stay exposed for an extended period.

"Many applications with web servers and similar will likely remain vulnerable until their respective vendors patch these items," Dataminr said.

The overall picture suggests widespread interest in the PHP2Shell flaws, but current evidence points to limited success in weaponizing them at scale.