Executive Summary
A wave of mass exploitation attempts has been observed targeting PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) shortly after their disclosure. While initial reports suggest reliability issues for attackers, successful exploitation leads to unauthenticated remote code execution (RCE) on systems running PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Technically, the campaign involves sophisticated scanning and fingerprinting to identify vulnerable mod_php configurations. The Potassium botnet, a Mirai fork, has been identified as a primary payload, utilizing ChaCha20 encryption for static configurations and DNS misdirection techniques to evade detection. The botnet establishes a Command-and-Control (C2) channel on TCP port 50792 to facilitate volumetric flood attacks.
The business impact is significant due to the ubiquity of PHP, with over 34 million services estimated to be vulnerable. Several government, healthcare, and educational institutions have proactively taken services offline to mitigate risk. Given the presence of functional exploit tooling that can bypass ASLR on x86-64 systems, immediate patching or upgrading to supported PHP branches is critical.