PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two newly disclosed PHP vulnerabilities. Their importance is that an attacker does not need to log in first. A specially crafted HTTP request can potentially make the server execute commands chosen by the attacker. Both flaws have a CVSS score of 9.2, indicating serious risk.

The exploit chain targets particular PHP and server configurations. SOCRadar described a tool for PHP 8.4.26 running under Apache mod_php. It recycles a PHP worker, leaks memory addresses through a session cookie, defeats ASLR, and abuses PHP session upload-progress handling to run a shell command.

The vulnerabilities were patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, Sophos observed unsuccessful attempts to use them against systems. The failures suggest that turning the theoretical command-execution path into a reliable attack remains difficult.

The observed campaign was not measured as a global infection wave, but researchers identified a specific attack chain. Three source IP addresses launched the attempts. Those sources contacted one additional server to retrieve a loader, which deployed the Potassium Mirai variant. The campaign then focused its DDoS activity on two adjacent hosts in one Ukrainian network.

The three attack sources were 85.11.167[.]243, 217.60.242[.]76, and 45.198.224[.]169. They contacted 92.118.112[.]100 for the loader. The two intended targets were 45.88.138[.]0 and 45.88.138[.]44. Sandboxed analysis also linked the malware to a C2 address and TCP port 50792.

A separate SOCRadar investigation found exploit tooling on another exposed server and three screening scripts. Those scripts checked about 20 public websites in several countries for PHP versions, server setup, and session settings. The figures show targeted reconnaissance, not a confirmed count of successful compromises.

Mirai is a malware family associated with botnets, or collections of compromised devices controlled for coordinated actions. The article describes Potassium as an updated and expanded Mirai-derived variant. Its ability to execute DDoS attacks makes infected Linux systems useful as traffic-generating nodes against chosen targets.

Attackers attempted to use PHP2Shell to gain command execution on exposed PHP servers without authentication. The malware could then download a follow-on Linux ELF binary, connect to command-and-control infrastructure, and receive attack instructions. Arctic Wolf found support for 24 commands covering ICMP, TCP, UDP, and OpenVPN flood attacks.

This strategy can expand the attacker’s pool of devices and make sustained volumetric attacks stronger. Yet the observed PHP2Shell attacks were unsuccessful, suggesting reliable exploitation is still difficult. Potassium also includes advanced features such as encrypted configuration, DNS misdirection, and inactive ENS-resolution capability.

After infection, Potassium establishes a communication channel with its operators and prepares the device for network disruption. Sophos identified downloader and network-disruption functionality. The malware expects a Linux ELF binary as a follow-on payload, meaning the infected system can receive and execute additional Linux code.

The sample resolves an encrypted C2 address, connects to 134.199.154[.]64, and checks for an HTTP 200 response. It verifies that the downloaded payload begins with the ELF magic bytes 7F 45 4C 46. The malware then uses its control channel to receive commands. Arctic Wolf found 24 commands for ICMP, TCP, UDP, and OpenVPN floods.

A sustained volumetric flood sends large amounts of traffic toward a target. That can strain network links and services, making systems difficult to reach. In this campaign, the stated end goal was to attack 45.88.138[.]0 and 45.88.138[.]44, two adjacent hosts in one Ukrainian network.

A vulnerability can be severe on paper yet difficult to exploit reliably in real environments. Sophos found attempts to use PHP2Shell, but none succeeded in the observed activity. The lack of a successful wild attack suggests operators are struggling to build an exploit chain that works consistently across exposed servers.

SOCRadar’s tooling shows why conditions matter. Its central script targeted PHP 8.4.26 under Apache mod_php. It recycled the PHP worker, leaked memory addresses through the session cookie to defeat ASLR, and abused PHP’s session upload-progress handling to execute a shell command. Companion scripts checked PHP versions, server setup, and session settings first.

Therefore, the server must match the expected PHP and web-server arrangement, expose the needed session behavior, and provide the conditions required by the memory-leak and worker-recycling steps. Different configurations can break the chain. Updated PHP versions also remove the vulnerable code path identified by the article.

These components form a control pipeline. DNS resolution converts a hostname into an IP address, allowing malware to locate infrastructure that may not be written directly as a plain address. The command-and-control server then provides a channel through which operators can send instructions and malware can report or retrieve data.

In the analyzed sample, Potassium queried thunder.godofthunder[.]st. The name resolved to 134.199.154[.]64, and the malware opened a C2 connection on TCP port 50792. It sent an HTTP request, checked for status 200, and verified that the returned content began with 7F 45 4C 46, the ELF signature for a Linux binary.

The binary is a follow-on payload that can add functionality after the initial compromise. The malware’s resolver supports IPv4 addresses and hostnames, with fallback DNS servers including 8.8.8.8, 1.1.1.1, and 1.0.0.1. The sample can then receive commands for network disruption and DDoS activity.

Address Space Layout Randomization, or ASLR, is a built-in security mechanism. It changes the memory locations used by programs and system files each time they run. This matters because many memory-based exploits depend on knowing where useful code or data will be located. Random placement makes those addresses harder to predict remotely.

The PHP2Shell tooling described by SOCRadar includes a step specifically designed to defeat ASLR. It leaks memory addresses through the target’s session cookie. The exploit can then use those addresses while abusing PHP’s session upload-progress handling to run a shell command. Without a dependable address leak, the same payload may point to the wrong location and fail.

ASLR does not make remote code execution impossible. It adds uncertainty that exploit developers must overcome, often alongside other server-specific requirements. The article’s failed attack attempts show the practical consequence: even with high-severity vulnerabilities, building a reliable chain can be difficult when memory behavior and PHP session conditions vary.