Millions of PHP2Shell Attack Attempts — Yet Not One Has Worked

Weeks after the disclosure of the flaws collectively dubbed PHP2Shell, the internet has been swamped with attempts to exploit them. The two bugs sit in the PHP engine itself — CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) — and allow unauthenticated remote code execution via specially crafted HTTP requests. Fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The scale is striking. Cloudflare recorded tens of thousands of attempts within 45 minutes of the public announcement, hundreds of thousands within two hours, and millions by 22 October. Yet researchers at Cisco Talos, Previdian, Wordfence and others agree on one point: so far this is mostly scanning and scattered attempts to deliver payloads. No confirmed remote code execution and no dropped PHP files have been observed.

The exploit is harder than expected

One actor tried to enlist infected machines into a Mirai variant called Potassium — a fork that encrypts its config with ChaCha20 and sports downloader and DDoS functionality. The goal was volumetric flood attacks against two adjacent hosts on a single Ukrainian network. It failed. The absence of successful attacks, Sophos notes, suggests attackers are "struggling" to build a reliable exploit.

The main obstacle is ASLR, which randomizes where code loads in memory. VulnCheck says it has developed a novel technique that chains the two vulnerabilities together: a memory leak defeats ASLR and achieves code execution on x86-64 systems even with PHP's recommended production configuration. The firm found no other public or commercial exploit achieving this under the same conditions.

A long tail, Log4Shell-style

The vulnerable code, Sysdig estimates, dates back to PHP 5.4 from 2012 and lives in the engine rather than in applications. As a result, even a cleanly written WordPress, Drupal or Joomla site remains exposed. With no fixes for older branches, experts expect PHP2Shell to linger for a long time — much like Log4Shell. According to Censys, PHP runs on more than 3 million hosts, and over 34 million services were still assessed as vulnerable as of 23 October.

As a precaution, a number of government, school and hospital websites across Asia, Europe and North America have gone offline. The UK government confirmed that 32 digital services are unavailable, and its National Cyber Security Centre issued roughly 50,000 warnings to organizations.

Source: The Hacker News