Record

Millions

Ethereum

Ethereum Name Service

<blockquote class="wp-block-quote">
 “viable and very serious.”
 — John Hultquist, Google, quoted by <a href="https://therecord.media/php-php2shell-exploitation-attempts-pocs" rel="noopener noreferrer nofollow">The Record</a>.
</blockquote>
<h3 class="wp-block-heading" id="strong-why-a-ddos-botnet-worries-hosting-and-crypto-operators-strong">Why a DDoS botnet worries hosting and crypto operators</h3>
The wider threat is already substantial. <a href="https://blog.cloudflare.com/ddos-threat-report-2026-h1/" rel="noopener noreferrer nofollow">Cloudflare</a> recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026.
Those attacks were not attributed to Potassium. Still, they illustrate the disruption facing hosting providers, payment processors and crypto platforms. No financial losses have been linked to PHP2Shell.
<h3 class="wp-block-heading" id="strong-php-s-new-advisory-and-what-to-watch-strong">PHP’s new advisory and what to watch</h3>
On October 23, <a href="https://www.php.net/archive/2026.php" rel="noopener noreferrer nofollow">PHP</a> disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends session.upload_progress.enabled=0, also a mitigation for CVE-2026-109619.
Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers and monitor suspicious downloads.
Cobalt CISO Andrew Obadiaru warned that this quiet period is:
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 “borrowed time.”
 — Andrew Obadiaru, Cobalt, quoted by <a href="https://therecord.media/php-php2shell-exploitation-attempts-pocs" rel="noopener noreferrer nofollow">The Record</a>.
</blockquote>
<blockquote class="wp-block-quote">
 “garbage and nonfunctional.”
 — Spencer McIntyre, VulnCheck, quoted by <a href="https://therecord.media/php-php2shell-exploitation-attempts-pocs" rel="noopener noreferrer nofollow">The Record</a>.
</blockquote>
That protection is not foolproof. <a href="https://www.vulncheck.com/blog/php2shell-vulnerabilities" rel="noopener noreferrer nofollow">VulnCheck</a> developed a private exploit bypassing ASLR on production-configured PHP 8.4.26, later expanding support to selected 8.4 and 8.5 builds.
Google’s John Hultquist called the threat:
<blockquote class="wp-block-quote">
 “viable and very serious.”
 — John Hultquist, Google, quoted by <a href="https://therecord.media/php-php2shell-exploitation-attempts-pocs" rel="noopener noreferrer nofollow">The Record</a>.
</blockquote>
<h3 class="wp-block-heading" id="strong-why-a-ddos-botnet-worries-hosting-and-crypto-operators-strong">Why a DDoS botnet worries hosting and crypto operators</h3>
The wider threat is already substantial. <a href="https://blog.cloudflare.com/ddos-threat-report-2026-h1/" rel="noopener noreferrer nofollow">Cloudflare</a> recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026.
Those attacks were not attributed to Potassium. Still, they illustrate the disruption facing hosting providers, payment processors and crypto platforms. No financial losses have been linked to PHP2Shell.
<h3 class="wp-block-heading" id="strong-php-s-new-advisory-and-what-to-watch-strong">PHP’s new advisory and what to watch</h3>
On October 23, <a href="https://www.php.net/archive/2026.php" rel="noopener noreferrer nofollow">PHP</a> disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends session.upload_progress.enabled=0, also a mitigation for CVE-2026-109619.
Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers and monitor suspicious downloads.
Cobalt CISO Andrew Obadiaru warned that this quiet period is:
<blockquote class="wp-block-quote">
 “borrowed time.”
 — Andrew Obadiaru, Cobalt, quoted by <a href="https://therecord.media/php-php2shell-exploitation-attempts-pocs" rel="noopener noreferrer nofollow">The Record</a>.
</blockquote>
Attackers are trying to turn vulnerable PHP servers into Potassium bots, part of a Mirai-derived network designed for distributed denial-of-service (DDoS) attacks. But so far, they have struggled. <a href="https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html" rel="noopener noreferrer nofollow">The Hacker News</a> reported on October 23 that no server compromises had been confirmed.
There were two major PHP vulnerabilities that were the main targets of the cyber attacks – CVE-2026-109618 and CVE-2026-109619, both of which received 9.2 out of 10 scores in terms of severity. PHP made the <a href="https://www.cryptopolitan.com/php2shell-flaws-millions-attack-attempts-ai/" rel="noopener noreferrer nofollow">patches available on October 21</a>, but by that time hackers had already started launching attacks against these vulnerabilities.
<h3 class="wp-block-heading" id="strong-what-sophos-saw-then-walked-back-strong">What Sophos saw, then walked back</h3>
<a href="https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution" rel="noopener noreferrer nofollow">Arctic Wolf reports</a> that attempted command execution and malware downloads have been attributed to Potassium. <a href="https://cowrai.com/research/php2shell-godofthunder" rel="noopener noreferrer nofollow">Another assessment</a> performed in a sandbox environment revealed a different sample that reached out to thunder.godofthunder[.]st through IP 134.199.154[.]64 at TCP port 50792 and attacked two Ukrainian hosts.
It demonstrated the potential of the malware but not that the attackers have breached the production servers. On October 22, Sophos retracted a prior success announcement, saying to <a href="https://therecord.media/php-php2shell-exploitation-attempts-pocs" rel="noopener noreferrer nofollow">The Record</a> that it had only observed unsuccessful attack attempts.
<h3 class="wp-block-heading" id="strong-millions-of-probes-zero-confirmed-break-ins-strong">Millions of probes, zero confirmed break-ins</h3>
However, the figures do indicate the extent to which attackers are probing. <a href="https://www.imperva.com/blog/php2shell-early-attack-activity-through-impervas-lens" rel="noopener noreferrer nofollow">Imperva recorded</a> 482,342 request attempts in 122,311 sessions aimed at 21,998 sites in 103 countries within a 24-hour period.
At the same time, <a href="https://therecord.media/php-php2shell-exploitation-attempts-pocs" rel="noopener noreferrer nofollow">Censys reported</a> detecting over 41 million internet-facing PHP services running versions that were affected and only about 1 million instances of deployment of patched versions of the software by October 22. The numbers reflecting scanning incidents or the number of individuals exposed are insufficient to prove an actual compromise happened.
<figure class="wp-block-image size-large">
 <figure style="width: 100%" class="wp-caption alignnone"><img src="https://www.cryptopolitan.com/wp-content/uploads/2026/10/PHP2Shell-by-the-numbers-1024x576.png" alt="" width="1024" height="576">
 <figcaption>
 PHP2Shell Attacks: 41 Million Exposed PHP Services and Potassium DDoS Threat
 </figcaption>
 </figure>
</figure>
<h3 class="wp-block-heading" id="strong-24-flood-commands-and-a-dormant-ens-switch-strong">24 flood commands and a dormant ENS switch</h3>
<a href="https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/" rel="noopener noreferrer nofollow">Arctic Wolf has revealed</a> that 24 flood commands include all types of ICMP, TCP, UDP, and Open VPN. There is also the presence of Ethereum Name Service (ENS) lookup features in both ARM and x86-64 Potassium versions, but this has been turned off in both instances.
Ethereum and ENS have not been compromised. However, activating the ENS lookup features can lead to a more difficult way of blocking command servers with any use of conventional DNS and IP controls.
<h3 class="wp-block-heading" id="strong-garbage-pocs-versus-a-working-private-exploit-strong">Garbage PoCs versus a working private exploit</h3>
Many public proof-of-concept (PoC) exploits fail against production defenses, particularly address space layout randomization (ASLR). VulnCheck’s Spencer McIntyre described many circulating samples as:
<blockquote class="wp-block-quote">
 “garbage and nonfunctional.”
 — Spencer McIntyre, VulnCheck, quoted by <a href="https://therecord.media/php-php2shell-exploitation-attempts-pocs" rel="noopener noreferrer nofollow">The Record</a>.
</blockquote>
That protection is not foolproof. <a href="https://www.vulncheck.com/blog/php2shell-vulnerabilities" rel="noopener noreferrer nofollow">VulnCheck</a> developed a private exploit bypassing ASLR on production-configured PHP 8.4.26, later expanding support to selected 8.4 and 8.5 builds.
Google’s John Hultquist called the threat:
<blockquote class="wp-block-quote">
 “viable and very serious.”
 — John Hultquist, Google, quoted by <a href="https://therecord.media/php-php2shell-exploitation-attempts-pocs" rel="noopener noreferrer nofollow">The Record</a>.
</blockquote>
<h3 class="wp-block-heading" id="strong-why-a-ddos-botnet-worries-hosting-and-crypto-operators-strong">Why a DDoS botnet worries hosting and crypto operators</h3>
The wider threat is already substantial. <a href="https://blog.cloudflare.com/ddos-threat-report-2026-h1/" rel="noopener noreferrer nofollow">Cloudflare</a> recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026.
Those attacks were not attributed to Potassium. Still, they illustrate the disruption facing hosting providers, payment processors and crypto platforms. No financial losses have been linked to PHP2Shell.
<h3 class="wp-block-heading" id="strong-php-s-new-advisory-and-what-to-watch-strong">PHP’s new advisory and what to watch</h3>
On October 23, <a href="https://www.php.net/archive/2026.php" rel="noopener noreferrer nofollow">PHP</a> disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends session.upload_progress.enabled=0, also a mitigation for CVE-2026-109619.
Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers and monitor suspicious downloads.
Cobalt CISO Andrew Obadiaru warned that this quiet period is:
<blockquote class="wp-block-quote">
 “borrowed time.”
 — Andrew Obadiaru, Cobalt, quoted by <a href="https://therecord.media/php-php2shell-exploitation-attempts-pocs" rel="noopener noreferrer nofollow">The Record</a>.
</blockquote>
The smartest crypto minds already read our newsletter. Want in? <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">Join them</a>.

PHP2Shell attacks surge as Potassium botnet targets vulnerable servers

Table of Contents

Cryptopolitan_News

Other articles published on Oct 24, 2026

Join our free newsletter for daily crypto updates!