THREAT researchers warn that attackers are probing PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619; CVSS 9.2) to drive infected hosts into a Mirai-derived botnet variant named Potassium. The exploits revolve around unauthenticated remote code execution via crafted HTTP requests.
PHP has patched these flaws in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but the wild exploitation surface remains large: Censys estimates over 3.08 million hosts and 56.6 million web properties running PHP, with more than 34.4 million PHP services still vulnerable as of 23 October 2026. The article notes extensive scanning and exploitation attempts, with evidence of mass probing and attempts to drop payloads, though no confirmed RCE or shell deployments had been observed at the time of reporting.
Sophos and Arctic Wolf describe a more capable PHP2Shell variant that contacts a hard-coded C2 address, downloads a loader at 134.199.154[.]64 via a domain resolved from thunder.godofthunder[.]st, and then attempts to stage a Linux ELF payload on target systems. A resolver supports IPv4 and fallback DNS (including 8.8.8[.]8, 1.1.1[.]1, 1.0.0[.]1), and the sample includes functionality for DDoS output, with potential for 24 commands to flood via ICMP, TCP, UDP and OpenVPN.
Initial attack traffic originated from three IPs (85.11.167[.]243, 217.60.242[.]76, 45.198.224[.]169), and other activity points to a wider campaign across cloud, shared-hosting, and ISP networks; many targets ran older PHP releases (5.x–7.x). Be aware that defenders should prioritise patching and monitoring given the scale of exposed surfaces.