- Published on
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
- Authors
- Name
- DeepHorus
Threat actors are trying to exploit newly disclosed PHP2Shell flaws to recruit Linux systems into a Mirai botnet variant called Potassium, but attacks have failed. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, carry CVSS scores of 9.2 and permit unauthenticated remote code execution via crafted HTTP requests. Patches exist in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Sophos said Potassium is an updated, significantly expanded version of a Mirai-derived botnet identified in early 2026. It has downloader and network-disruption functions, resolves an encrypted command-and-control address, and connects to 134.199.154[.]64 over TCP. It checks for HTTP 200 and validates an ELF payload.
The malware can launch DDoS attacks, echoing Mirai’s history. Its resolver supports IPv4 and hostnames, with fallback DNS servers including 8.8.8.8, 1.1.1.1, and 1.0.0.1. The attacks came from 85.11.167[.]243, 217.60.242[.]76, and 45.198.224[.]169.
Those sources contacted 92.118.112[.]100 to retrieve a loader. In a sandbox, the botnet queried thunder.godofthunder[.]st, resolved it to 134.199.154[.]64, and opened C2 on TCP port 50792. The goal was sustained volumetric floods against 45.88.138[.]0 and 45.88.138[.]44, two adjacent hosts in a Ukrainian network.
Sophos said no successful PHP2Shell exploitation has been seen in the wild, suggesting attackers struggle to build reliable exploits. Potassium was first flagged by Synthient in March 2026. Nokia Deepfield noted ChaCha20 static-config encryption, a named reverse-shell protocol, and DNS misdirection.
Arctic Wolf said the botnet supports 24 commands for ICMP, TCP, UDP, and OpenVPN floods. ARM and x86 builds include Ethereum Name Service resolution for C2, but it was disabled. If enabled, ENS could complicate disruption by reducing reliance on registrars and DNS providers.
SOCRadar found PHP2Shell exploit tooling for PHP 8.4.26 on 206.188.197[.]105:9999 and screening scripts that check websites for required PHP versions, server setup, and session settings. The failed attempts show weaponizing high-severity flaws remains difficult even as mass scanning continues. Interest persists.
