RESEARCHERS have linked attempts to exploit PHP2Shell to a Mirai-derived botnet, with new ASLR-bypass exploits emerging, though no confirmed in‑the‑wild compromise has yet been demonstrated. Two days after PHP issued emergency fixes for the PHP2Shell flaws, threat actors reportedly tried to spread the Mirai-influenced payload, with activity spiking once patches were released.
Sophos and other researchers say the targeted efforts have not produced shell access on any systems observed so far, and exploitation remains difficult in practice.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are critical unauthenticated remote‑code‑execution flaws in PHP, each with a CVSS v4.0 score of 9.2. PHP patched these on 21 October 2026, releasing versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Vendors, security firms and government bodies issued advisories and detection rules in response.
Initial exploitation was spotted by Amazon before patches went live, and patching progress has varied widely: Qualys reported that around 199,000 PHP instances were patched within 12 hours, while an estimated 71% of installations run unsupported or end‑of‑life PHP versions.
Evidence from the attacker side includes an exposed PHP2Shell toolkit on an attacker‑controlled server, with an operator testing a “one‑click” chain against PHP 8.4.26 on Apache mod_php. SOCRadar and Hunt[.]io documented multiple target attempts across dozens of servers in several countries, but both noted no successful exploitation to date.
VulnCheck disclosed an ASLR bypass exploit for CVE‑2026‑109618 on x86‑64 production configurations, though public PoCs are limited and many deployments remain resistant under default settings.