Mirai Botnet Operators Exploit PHP2Shell Vulnerabilities Amid Emergency Patches

Recent activity surrounding the PHP2Shell vulnerabilities has heightened concerns within the cybersecurity community. Mirai botnet operators have begun attempting to exploit critical vulnerabilities in the PHP engine, two of which recently received emergency patches from PHP. With a notable rise in activity following the patches, organizations are taking extensive precautions to safeguard their systems from potential breaches.

Emergence of PHP2Shell Vulnerabilities

The vulnerabilities in question, identified as CVE-2026-109618 and CVE-2026-109619, were disclosed as critical security flaws that allow for unauthenticated remote code execution (RCE). With a CVSS v4.0 score of 9.2, they represent severe risks for PHP installations. Initially discovered by security researchers at Wiz, OpenAI, and Calif in August 2026, these flaws prompted PHP to expedite patching measures, releasing fixes on October 21, one day earlier than scheduled, after specific details regarding the vulnerabilities were leaked online.

Impact of Emergency Patches

The response from organizations has been swift. In the wake of the vulnerability disclosure, several noteworthy websites, including those belonging to government, schools, and hospitals across Europe, began experiencing outages starting October 21 as a preventative measure against potential exploitation. Notably, the UK government reported that 32 services were completely unavailable and four services were partially affected. These actions have been primarily a precautionary response to apply the necessary patches following their release.

First Attack Attempts and Detection Efforts

The first documented exploitation attempt surfaced on October 17, with Amazon identifying initial activity, just days before the patches became available. As of now, threat intelligence firm Sophos reveals that key actors have attempted to leverage these vulnerabilities to deploy a variant of the Mirai botnet named Potassium. Although an analysis of one attempt led to the malware being stopped before it could reach its intended target, the variant is noted for its enhanced capabilities compared to previous iterations. It can execute DDoS attacks and download additional malware, indicating a sophisticated evolution of Mirai-derived threats.

Exploit Difficulty and Lack of Confirmed Breaches

Despite the heightened attack activity, there is still no confirmed successful exploitation in the wild. Multiple cybersecurity firms, including Hunt.io and Wordfence, report neither successful compromises nor confirmed breaches resulting from these vulnerability exploits. This is corroborated by Sophos’ analysis, which points to the challenges attackers are facing in developing a reliable exploitation method. Both Hunt.io and Sansec, initially predicting swift mass exploitation attempts, have since revised their expectations. Sansec noted that attackers need specific knowledge about server conditions to effectively exploit the vulnerabilities, making success rare among installations with default settings.

ASLR Bypass and Its Implications

A critical aspect of the vulnerabilities' complexity lies in the challenge posed by address space layout randomization (ASLR), a security mechanism designed to prevent arbitrary code execution by randomizing memory address allocations. Researchers at VulnCheck assert they have developed an exploit for CVE-2026-109618 that circumvents ASLR protections in production setups. Their exploit leverages a memory leak to achieve RCE on x86-64 systems, contingent on configurations including PHP error display being turned off—an established production best practice.

Discoveries of Custom Exploit Tooling

In an investigative effort by SOCRadar, an attacker-controlled server was uncovered, revealing sophisticated PHP2Shell tooling intended for exploitation. The server housed files that outlined an exploit chain tailored for PHP version 8.4.26 running on Apache mod_php, promoted as a “one-click” exploit. The findings indicate the server operator conducted detailed vulnerability fingerprinting across about 20 websites across multiple countries, including the US, UK, and Canada. However, the exploit requried specific server configurations, which none of the examined sites possessed.

Patch Adoption and Community Response

Despite the urgency of the patches, analysis from cybersecurity firm Qualys indicates a lag in the deployment of updates. Out of approximately 110 million PHP instances running outdated versions from 5.4 through 8.1 (all past their end of life), only 199,000 instances were patched within 12 hours of the vulnerability disclosure. Furthermore, CISA, the Cybersecurity and Infrastructure Security Agency, had not included the vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog as of October 23, drawing attention to the potentially vast attack surface still exposed. Censys is actively tracking the patching progress in real time, showcasing ongoing efforts to mitigate the risks presented by PHP2Shell vulnerabilities.

PHP2Shell Vulnerabilities

Key Takeaways

• Critical PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 have a CVSS score of 9.2.
• Only 199,000 PHP instances were patched within 12 hours following the vulnerability disclosure.
• Attempted attacks leveraging these vulnerabilities have not led to confirmed successful compromises.
• Organizations, including government services, took offline precautionary measures impacting 32 services in the UK.
• VulnCheck developed an ASLR-bypassing exploit for the PHP vulnerabilities available to select customers.

In conclusion, while the PHP2Shell vulnerabilities present a significant threat, the lack of confirmed exploits and rapid patch dissemination indicate a somewhat mitigated risk landscape, albeit with ongoing vigilance required across the PHP ecosystem.