> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Mirai operators target PHP2Shell CVE-2026-109618 with ASLR bypass exploits - URL: https://f4n6.co.uk/security-feed/mirai-operators-target-php2shell-cve-2026-109618-with-aslr-bypass-exploits/ - Published: 2026-10-23T18:12:58.000Z - Updated: 2026-10-23T18:12:58.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-109618, CVE-2026-109619, Mirai, Potassium ## 1\. Executive summary PHP2Shell covers two critical PHP engine flaws, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 and both allowing unauthenticated remote code execution. Neither is in CISA KEV as of 2026-10-23\. EPSS stands at 12% for CVE-2026-109618 and 6% for CVE-2026-109619\. Exploitation attempts began on October 17, four days before PHP released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and attackers have tried to use the flaws to seed a Mirai-derived botnet called Potassium. No successful in-the-wild compromise has been confirmed by any vendor. The risk to EMEA financial services sits in unpatched internet-facing PHP, including end-of-life branches that will never receive a vendor fix, and in the fact that a working ASLR bypass now exists commercially for production configurations. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | Internet-facing PHP services at EU financial entities are exposed to unauthenticated RCE attempts, and several organisations took systems offline on October 21 as a precaution | The incident management process must cover attempted exploitation of exposed production services, not only confirmed breaches, including the decision to take services offline and the record of that decision | | DORA Art. 19 | Precautionary outages occurred across European government, school and hospital sites, and UK government reported 32 services unavailable and four partly unavailable | Where a precautionary takedown of a client-facing service meets the major-incident criteria, the reporting clock and the competent-authority notification route apply | | NIS2 Art. 21(2)(d) | Exposure runs through PHP components embedded in CMS platforms, hosting control panels and third-party-managed web estates | Supply chain security measures must extend to identifying which PHP versions third-party providers run on the entity's behalf, including forgotten marketing sites and hosted tools | ## 3\. Technical analysis & attack chain The confirmed sequence, from vendor and researcher reporting: 1. Amazon detected the first exploitation attempt against the PHP2Shell flaws on October 17, before public disclosure. 2. PHP released fixes on October 21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, one day ahead of plan, after the CVE identifiers leaked. Minimal source backports went out for 7.4, 8.0 and 8.1. 3. Attempted exploitation surged once the patches shipped. WatchTowr, Cloudflare, Patchstack, Vega and Hadrian all reported attempts; Hadrian said it saw exploitation at scale abusing PHP's session upload-progress path. 4. Sophos analysed an attempt to install Potassium, a Mirai-derived botnet, and blocked it before the malware reached the target. Sophos had earlier reported a successful exploitation and retracted that update. 5. Arctic Wolf linked two Potassium binaries to servers hosting PHP2Shell payloads but found no evidence the PHP2Shell requests fetched or ran them. 6. No vendor has reported a confirmed compromise. Hunt.io, Wordfence and Sophos all describe attempts and tooling preparation without success. The vulnerabilities. CVE-2026-109618 is an out-of-memory corruption bug; CVE-2026-109619 is a stale global state bug. NVD classifies both as CWE-416 (use after free) with CWE-755, while PHP Foundation and press reporting describe them as OOM corruption and stale global state; the two descriptions can cover the same memory-safety defects. Both sit in memory management and error handling, code paths nearly every request touches. RCE was confirmed on Apache with mod\_php. The PHP Foundation states all installations handling web requests are potentially at risk, naming PHP-FPM, Apache with mod\_php, php-cgi, FrankenPHP and LiteSpeed. The flaws affect releases back to PHP 5.4 and can also read sensitive process memory that may hold credentials and API keys. Wiz says the two CVE identifiers group four memory-safety issues and do not cover all variants. Why exploitation is hard. ASLR randomises memory locations and defeats naive attempts to guess a target address. VulnCheck reports that most of the hundreds of PoC repositories on GitHub are nonfunctional, and that the best in-the-wild attempts are ports of public PoCs. Sansec withdrew its prediction of mass exploitation within 15 minutes of patch release, saying attackers need detailed knowledge of a specific server and particular conditions, and that public exploits fail against default PHP installations. Marcus Hutchins of Expel told Recorded Future News that ASLR hinders mass exploitation even though it is not a permanent barrier, and that an internet-wide scanner able to identify vulnerable systems remotely is already running. The ASLR bypass. VulnCheck built an exploit for CVE-2026-109618 that chains a memory leak into RCE on PHP 8.4.26, on x86-64 with ASLR enabled and display\_errors=off, the recommended production setting. It is available only to VulnCheck Initial Access Intelligence customers. VulnCheck says it works on ARM64 but RCE is not currently functional there, and that it has not identified another public or commercial exploit achieving RCE under the same conditions. Attacker tooling. SOCRadar found an attacker-controlled server with browsable working files containing an exploit chain for PHP 8.4.26 on Apache mod\_php, tested in a lab and billed as one-click, plus companion scripts that checked whether real websites met the required configuration. The operator fingerprinted about 20 sites across the US, UK, Canada, France, Finland, Poland and China and probed 11 in depth; none met the requirements. Hunt.io's analysis of the same server counted 10 attack rounds against 123 servers on cloud, shared hosting and ISP infrastructure; roughly 57 ran PHP, 10 rejected the requests, and none was exploited. SOCRadar reported no evidence of shell access on any screened site as of October 22. Potassium. Sophos describes the sample as an updated build of a Mirai-derived strain first seen in early 2026, with expanded functionality, able to download additional malware and launch DDoS attacks. No file hashes, C2 addresses or command syntax for Potassium appear in the sources reviewed here. Attribution caveats. The link between the exploitation attempts and Mirai is single-sourced per vendor and inconsistent across firms: Sophos and Arctic Wolf name Potassium, Cobalt names Mirai, and Hunt.io attributes the traffic to an established Mirai-style botnet active since at least May 2026\. Mirai has no MITRE ATT&CK profile, so attribution to a specific botnet is unconfirmed. No named actor with a MITRE profile is identified in this item. Patching gap. Qualys, from anonymised data on 12,000 customers, counted 199,000 PHP instances patched within 12 hours of disclosure. It estimates roughly 110 million instances, 71%, run PHP 5.4 through 8.1, all end of life and most never to receive a vendor patch, and another 44 million run supported branches with fixes available but unapplied. Censys publishes a live dashboard of internet-facing PHP services still on vulnerable versions. ## 4\. Mitigation & containment P1, within 24 hours. Inventory every PHP runtime reachable from the internet and from partner networks, including CMS installs, hosting control panels, appliances with embedded PHP and forgotten marketing sites. Censys's public dashboard gives an external view of exposed services; reconcile it against internal records. Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35\. Where 7.4, 8.0 or 8.1 must stay, apply the minimal source backports PHP released for those branches. Treat any 5.4 through 8.1 instance without a backport as permanently exposed and plan its removal or network isolation. Do not rely on display\_errors=off or ASLR as protection. VulnCheck's exploit defeats both on x86-64 production configurations. Block exploitation attempts at the edge. The PHP Foundation states workarounds reduce exposure to specific attack paths without making an installation safe; apply vendor and WAF guidance from Cloudflare and other providers that issued stopgap rules, and log every block for retrospective review. P2, within 72 hours. Hunt for POST requests to PHP endpoints carrying oversized multipart bodies or session upload-progress parameters, the path Hadrian reported being abused at scale. Alert on PHP-FPM or Apache mod\_php worker crashes consistent with out-of-memory corruption, and on unexpected child processes spawned by web server workers. Search web-accessible directories for dropped binaries and review egress for DDoS tooling behaviour: sustained outbound UDP or TCP floods, IRC-style C2, and downloads of secondary payloads. Potassium's download-and-DDoS capability means an infected host will show outbound attack traffic before any inbound symptom. Rotate credentials, API keys and session secrets held in process memory on any host that ran a vulnerable version while exposed, given the confirmed memory-read primitive. P3, within 7 days. Extend the inventory to third-party and shared-hosting providers and obtain written confirmation of their PHP versions and patch state, consistent with the supply chain measures in NIS2 Art. 21(2)(d) and the third-party provisions in DORA Art. 28 to Art. 30. Add PHP version drift to continuous asset monitoring so end-of-life branches are flagged before the next disclosure. Qualys's figure of 71% of instances on unsupported branches indicates this is a standing exposure, not a one-off. ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IP addresses, file paths) appear in the sources reviewed. The sources describe behaviours and tooling but publish no machine-pivotable values. ### Behavioural indicators | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------- | | Exploitation attempts via PHP session upload-progress path | Web server and WAF logs, POST requests to PHP endpoints | Medium; single-sourced to Hadrian via SecurityWeek | | Out-of-memory corruption triggering worker crashes | PHP-FPM and Apache mod\_php error logs | Medium; consistent with CVE-2026-109618 mechanism | | Internet-wide scanning to fingerprint PHP versions | Perimeter IDS and WAF logs, sequential requests across hosts | Medium; reported by Hutchins and Detectify | | Potassium botnet download of secondary malware and DDoS launch | Endpoint egress, outbound flood traffic from web servers | Medium; single-sourced to Sophos | | Exploit chain targeting PHP 8.4.26 on Apache mod\_php with configuration probing | Web logs showing reconnaissance requests checking server configuration | Medium; single-sourced to SOCRadar and Hunt.io | No copyable indicator block is provided because no atomic indicators exist in the source material. ## 6\. Detection The sources give no file artefacts, command-line flags, mutexes or registry keys for Potassium or the PHP2Shell tooling, so a YARA rule built on threat artefacts cannot be written without fabricating strings. Detection rests on the behavioural signals above. ```yaml title: PHP2Shell Exploitation Attempt via Session Upload-Progress Path id: 7c1e4a92-3b6d-4f18-9a2e-php2shell01 status: experimental description: Detects POST requests to PHP endpoints carrying session upload-progress parameters, the exploitation path reported in the wild against CVE-2026-109618 and CVE-2026-109619. author: Adverse Trace date: 2026-10-23 references: - https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/ logsource: category: webserver detection: selection_method: cs-method: 'POST' selection_uri: cs-uri-query|contains: - 'PHP_SESSION_UPLOAD_PROGRESS' selection_body: cs-request-body|contains: - 'PHP_SESSION_UPLOAD_PROGRESS' condition: selection_method and (selection_uri or selection_body) falsepositives: - Legitimate applications using PHP session upload progress with large file uploads level: high ``` ```yaml title: PHP Worker Out-of-Memory Crash on Web Request id: 9d2f6b14-5c8a-4e37-b1f0-php2shell02 status: experimental description: Detects PHP-FPM or Apache mod_php worker crashes consistent with the out-of-memory corruption mechanism in CVE-2026-109618, which may indicate exploitation attempts. author: Adverse Trace date: 2026-10-23 references: - https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/ logsource: product: linux service: php-fpm detection: keywords: - 'Allowed memory size' - 'Out of memory' - 'segfault' condition: keywords falsepositives: - Genuine application memory exhaustion under load level: medium ``` Tune both rules against baseline traffic before alerting; the upload-progress parameter is legitimate in some applications. ## CVE assessment 2 referenced CVEs — 2 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | --------- | ---- | ------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618?ref=f4n6.co.uk) | 9.2 Critical | — | 12% | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts… | | [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619?ref=f4n6.co.uk) | 9.2 Critical | — | 6% | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly… | ## Threat actor context **menuPass** · [G0045](https://attack.mitre.org/groups/G0045?ref=f4n6.co.uk) · aka Cicada, POTASSIUM, Stone Panda, APT10, Red Apollo [menuPass](https://attack.mitre.org/groups/G0045?ref=f4n6.co.uk) is a threat group that has been active since at least 2006\. Individual members of [menuPass](https://attack.mitre.org/groups/G0045?ref=f4n6.co.uk) are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company. … *No MITRE ATT&CK profile for: Mirai.* ## 7\. Sources - SecurityWeek, Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge, https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/, 2026-10-23 - SecurityWeek, PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors, https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/, October 2026 - The Hacker News, PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware, https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html, October 2026 - The Record (Recorded Future), Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits, https://therecord.media/php-php2shell-exploitation-attempts-pocs, October 2026 - The Record (Recorded Future), Hundreds of websites taken offline as concern grows over two PHP vulnerabilities, https://therecord.media/php-script-vulnerabilities-warnings, October 2026 - Cybersecurity Dive, PHP exploitation moves at slower-than-expected pace, but millions remain at risk, https://www.cybersecuritydive.com/news/php-exploitation-slower-than-expected/833855/, October 2026 - The Register, PHP2Shell exploit bypasses protections designed to stop remote code execution, https://www.theregister.com/security/2026/10/22/php2shell-exploit-bypasses-protections-designed-to-stop-remote-code-execution/5304883, 2026-10-22 ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-109618 and CVE-2026-109619 as CVSS 9.2 critical, not in CISA KEV, with EPSS of 12% and 6% respectively. The absence of a confirmed compromise and the low EPSS reflect genuine exploitation difficulty, not safety: a commercial ASLR bypass now works against recommended production configurations, and the population of unpatched and end-of-life PHP instances is large enough that a working public exploit would change the picture quickly. The Mirai and Potassium attribution is unconfirmed and single-sourced per vendor, and no MITRE profile exists for Mirai. For EMEA financial clients the exposure is concentrated in internet-facing PHP they may not know they run, including third-party and hosted estates. We will monitor CISA KEV status, Censys patching data and vendor reporting for the first confirmed compromise or public release of a working production exploit, and will reissue this advisory if either occurs. Clients should confirm their PHP inventory and patch state to Adverse Trace by 2026-10-30 so we can assess exposure against the DORA Art. 17 and Art. 19 obligations above. --- [Read the original source →](https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*