> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Potassium botnet exploits critical PHP flaws CVE-2026-109618 and CVE-2026-109619 - URL: https://f4n6.co.uk/security-feed/potassium-botnet-exploits-critical-php-flaws-cve-2026-109618-and-cve-2026-109619/ - Published: 2026-10-23T18:15:00.000Z - Updated: 2026-10-23T18:15:00.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-109618, CVE-2026-109619, Potassium ## 1\. Executive summary Two critical PHP engine flaws, CVE-2026-109618 and CVE-2026-109619, both scored CVSS 9.2 and both unauthenticated remote code execution, were patched by the PHP project on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35\. Neither CVE is in CISA KEV. EPSS stands at 12% for CVE-2026-109618 and 6% for CVE-2026-109619\. Exploitation attempts have been widespread since disclosure, and the Potassium botnet, a Mirai-derived strain, has been observed trying to install itself through the flaws, but no vendor has confirmed a successful in-the-wild compromise. The exposure for EMEA financial services is the installed base rather than the exploit: PHP 8.1 and older receive no fix, and roughly half of PHP-backed sites run versions that will never be patched. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 28 | PHP is embedded across hosting providers, CDNs and third-party web platforms, and the fix depends on each provider's own patch cycle | Firms must confirm patch status with hosting and platform providers under third-party risk principles, not assume the upstream PHP release reached their instances | | DORA Art. 24 | The flaws are remotely reachable in production configurations, and a commercial exploit defeating ASLR now exists | Internet-facing PHP estates fall within the scope of resilience testing; test for the patched versions rather than relying on generic scanning | | NIS2 Art. 21(2)(d) | Exposure sits in the supply chain: managed hosting, CMS platforms and forgotten internal tools running unsupported PHP | Supply chain security measures apply to the PHP components and hosting arrangements a firm depends on | ## 3\. Technical analysis & attack chain The two flaws sit in different parts of PHP's memory management and are chained for a more reliable path than either alone. Tenable names CVE-2026-109618 as OOM Corruption and CVE-2026-109619 as Stale Global State. Both yield unauthenticated remote code execution. NVD classifies both as CWE-416 (Use After Free) with CWE-755; the source reporting describes the mechanisms by their memory-management behaviour rather than by CWE, and both descriptions fit the same defect class. The flaws affect every PHP version from 5.4 onward. Fixes are in 8.5.12, 8.4.27, 8.3.36 and 8.2.35\. PHP 8.1 and older will not be patched. Confirmed steps in observed activity: 1. An attacker sends a crafted request to a PHP endpoint on a vulnerable version. No authentication is required. 2. The request triggers the memory corruption path. Public proof-of-concept exploits mostly target the `display_errors` setting, which is uncommon in production, so most attempts fail at this stage. 3. Where the chain completes, the attacker achieves code execution in the web server context. 4. Observed post-exploitation attempts deliver the Potassium botnet. Arctic Wolf saw one attempt that combined command-execution validation with second-stage payload delivery, and identified two malicious binaries in the payload hosting infrastructure. It found no evidence the binaries were downloaded or executed. 5. Sophos observed a Potassium delivery attempt and blocked it. The sample it examined was an updated, significantly expanded build of the Mirai-derived strain first seen in early 2026, with the ability to download additional malware and launch DDoS attacks. The main barrier to exploitation is address space layout randomization. VulnCheck reports an exploit for CVE-2026-109618 that uses a memory leak to reach code execution on x86-64 systems with ASLR enabled and `display_errors` off, the recommended production configuration. That exploit is available to VulnCheck's Initial Access Intelligence customers and is not public. VulnCheck states it is not aware of any other public or commercial exploit achieving RCE on multiple PHP versions in production configurations. No successful compromise has been confirmed. Sophos, Hunt.io, Wordfence and Arctic Wolf all report attempts without confirmed success, and Sophos corrected an earlier update in which it had reported a successful exploitation. Sansec, which had predicted mass exploitation within 15 minutes of patch release, revised that assessment on 22 October, saying attackers need detailed knowledge of a specific server and particular conditions to succeed, and that public exploits fail against default PHP installations. Attribution to Potassium rests on Sophos and Arctic Wolf reporting and is single-sourced per vendor; no vendor has tied the activity to a named intrusion set with a MITRE ATT&CK profile. The actor menuPass (G0045) appears in threat intelligence holdings but no source in this item links menuPass to PHP2Shell exploitation or to Potassium, so that attribution is unconfirmed and should not be used. The flaws were found in August 2026 by Wiz, OpenAI and Calif, with Calif using OpenAI's GPT-5.6 Sol model and Wiz also using frontier models. Amazon spotted the first exploitation attempt on 17 October, before the 21 October patch. Cloudflare implemented WAF rules at 03:02 UTC on patch day. Government agencies in the EU, UK, Germany, Japan, Australia, the Netherlands and Canada issued warnings, and several took services offline as a precaution; the UK government reported 32 services unavailable and four partly unavailable, mostly from precautionary measures. ## 4\. Mitigation & containment P1, within 24 hours: - Inventory every PHP instance, including forgotten marketing sites, hosting control panels and devices with PHP built in. The Record quotes Detectify's point that the risk is in systems nobody is watching. - Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35\. Confirm the running version with `php -v` on each host and through the package manager, since web-facing version strings can be masked. - For any instance that cannot be patched immediately, take it offline. This is what several European governments did, and it is the only reliable containment for an unauthenticated RCE with no KEV-listed exploitation yet. - Enable Cloudflare WAF rules if the firm uses Cloudflare; the provider deployed rules on 21 October. - Check hosting and CDN providers for their patch status in writing. A firm's own servers may be patched while a managed platform is not. P2, within 72 hours: - Identify PHP 8.1 and older installations. These will not receive a fix. Plan migration or decommissioning; there is no patch path. - Search web server logs for POST requests to PHP endpoints returning 200 or 500 in unusual volume, and for requests followed by outbound connections to unfamiliar hosts. - Review for web shells. Wiz assesses mass exploitation is likely to install web-based backdoors, so check document roots for recently modified or unexpected PHP files. P3, within 7 days: - Add version checks for the four fixed releases to vulnerability management and configuration baselines. - Where PHP runs inside a CMS (Drupal, Joomla, WordPress, Magento), confirm the CMS vendor has shipped an updated PHP dependency or document the manual upgrade. - Test the production configuration specifically: ASLR on and `display_errors` off does not protect against the VulnCheck exploit chain. ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IPs, file paths) are present in the source material. The reporting describes behaviours and named malware but publishes no machine-pivotable values. Behavioural indicators: | behaviour | where to observe | confidence | | --------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------- | | POST requests to PHP endpoints crafted to trigger memory corruption, often failing against default display\_errors settings | Web server access logs, WAF logs | Medium; described by VulnCheck and Sansec, no request signature published | | Command-execution validation followed by second-stage payload retrieval | Web server process tree, outbound HTTP from the web server | Medium; single-sourced to Arctic Wolf | | Potassium botnet download and DDoS capability | EDR on web servers, outbound traffic from DMZ hosts | Medium; single-sourced to Sophos | | Web shell installation in document roots | File integrity monitoring on web roots | Low; assessed by Wiz as likely, not observed | ## 6\. Detection Insufficient indicators to author detection rules. The sources name the malware family and describe its capabilities but publish no strings, filenames, command lines, registry keys or network values that could be used in a YARA or Sigma rule. Detection should rely on the behavioural indicators in section 5 and on version checks for the four fixed PHP releases. ## CVE assessment 2 referenced CVEs — 2 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | --------- | ---- | ------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618?ref=f4n6.co.uk) | 9.2 Critical | — | 12% | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts… | | [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619?ref=f4n6.co.uk) | 9.2 Critical | — | 6% | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly… | ## Threat actor context **menuPass** · [G0045](https://attack.mitre.org/groups/G0045?ref=f4n6.co.uk) · aka Cicada, POTASSIUM, Stone Panda, APT10, Red Apollo [menuPass](https://attack.mitre.org/groups/G0045?ref=f4n6.co.uk) is a threat group that has been active since at least 2006\. Individual members of [menuPass](https://attack.mitre.org/groups/G0045?ref=f4n6.co.uk) are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company. … ## 7\. Sources - Cybersecurity Dive, "PHP exploitation moves at slower-than-expected pace, but millions remain at risk", https://www.cybersecuritydive.com/news/php-exploitation-slower-than-expected/833855/, 2026-10-23 - SecurityWeek, "Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge", https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/ - The Hacker News, "PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware", https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html - Cybersecurity Dive, "Critical PHP vulnerabilities expose vast majority of websites to potential compromise", https://www.cybersecuritydive.com/news/php-website-vulnerabilities/833580/ - The Record, "Hundreds of websites taken offline as concern grows over two PHP vulnerabilities", https://therecord.media/php-script-vulnerabilities-warnings - Tenable Research, "The adversary economy: How threat actors are reacting to PHP2Shell", https://www.tenable.com/blog/php2shell-vulnerability-threat-actor-response - Krebs on Security, "Widespread PHP Flaw May Cause Many Site Outages Today", https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/ ## 8\. Adverse Trace position Adverse Trace assesses the risk to EMEA financial services as high but not yet realised. Both CVEs are CVSS 9.2 critical, neither is in CISA KEV, and EPSS of 12% and 6% reflects active but largely unsuccessful exploitation. The confirmed exposure is the unpatched installed base, particularly PHP 8.1 and older, which has no fix. The Potassium activity is real but single-sourced per vendor and has not produced a confirmed compromise. We will monitor for the first confirmed in-the-wild compromise and for public release of a working ASLR-bypass exploit, and will reissue this advisory if either occurs. Clients should treat the version inventory as the priority action this week. --- [Read the original source →](https://www.cybersecuritydive.com/news/php-exploitation-slower-than-expected/833855/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*