An analysis of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) revealing unauthenticated remote code execution vectors via HTTP requests.
Following public disclosure, millions of automated exploit attempts were logged globally, attempting to co-opt systems into a Mirai botnet variant.
PHP released official patches in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
What are security vulnerabilities in PHP?
The issues are located in the core of PHP, a technology widely used to power millions of websites and online services around the world. The vulnerabilities could theoretically allow an attacker to execute commands on a remote system without requiring a password. PHP developers have released official updates to fix the issue in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Huge wave of test attacks
Shortly after the issues were made public, internet infrastructure providers such as Cloudflare noticed tens of thousands of attempts within minutes, which reached millions by October 22, 2026. Many of these attempts attempt to integrate systems into a variant of a known attack network called Potassium.
Despite the huge number of attempts, many cybersecurity companies, including Sophos, Previdian, Beelzebub, Dataminr, and Wordfence, have reported no successful remote command executions or known breaches. Researchers have also identified attack tools and scripts on an exposed server controlled by unknown parties, while other researchers have developed techniques to bypass certain protections on specific systems.
READ ALSO
Cyberattack on Capcom may have exposed emails of millions of users
Preventive service closures
The severity of the situation has led governments, schools and hospitals in Asia, Europe and North America to take some of their digital services offline as a precaution. The UK government has confirmed that dozens of digital services have become temporarily unavailable as a result of these precautionary measures.
As infrastructure monitoring organizations identify millions of services that are still considered vulnerable, experts emphasize the need to immediately update systems.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)