PHP2Shell: Millions of Exploit Attempts Targeting Critical PHP RCE Flaws to Deploy Mirai's Potassium Botnet
In October 2026, threat actors launched millions of exploitation attempts against two critical PHP vulnerabilities—CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2)—targeting unauthenticated remote code execution via crafted HTTP requests. Attackers attempted to deploy the Mirai-derived Potassium botnet, which uses ChaCha20-encrypted configuration, ENS-based C2 resolution, and supports 24 DDoS flood commands across ICMP, TCP, UDP, and OpenVPN protocols. Cloudflare observed hundreds of thousands of exploit attempts within two hours of public disclosure, escalating to millions by October 22. Over 34.4 million PHP services remained vulnerable as of October 23, prompting precautionary shutdowns of government, hospital, and school websites across Asia, Europe, and North America. PHP2Shell is drawing comparisons to Log4Shell due to its deep engine-level origin dating to PHP 5.4 (2012), meaning no application-layer fix suffices. With 56.6 million web properties running PHP and patches unavailable for end-of-life branches, organizations face a prolonged exposure window. The rise of ASLR-bypass techniques and automated exploit toolkits signals escalating attacker sophistication targeting cloud-hosted and shared-hosting PHP environments.
Kill Chain
