- Attackers are trying to use PHP2Shell to install the Mirai-derived Potassium DDoS botnet.
- Researchers have seen widespread exploitation attempts but no publicly confirmed mass compromises as of October 23.
- Working production exploits now exist, increasing pressure on administrators to patch vulnerable PHP installations.
“viable and very serious.”
— John Hultquist, Google, quoted by The Record.
Why a DDoS botnet worries hosting and crypto operators
The wider threat is already substantial. Cloudflare recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026.
Those attacks were not attributed to Potassium. Still, they illustrate the disruption facing hosting providers, payment processors and crypto platforms. No financial losses have been linked to PHP2Shell.
PHP’s new advisory and what to watch
On October 23, PHP disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends session.upload_progress.enabled=0, also a mitigation for CVE-2026-109619.
Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers and monitor suspicious downloads.
Cobalt CISO Andrew Obadiaru warned that this quiet period is:
“borrowed time.”
— Andrew Obadiaru, Cobalt, quoted by The Record.
“garbage and nonfunctional.”
— Spencer McIntyre, VulnCheck, quoted by The Record.
That protection is not foolproof. VulnCheck developed a private exploit bypassing ASLR on production-configured PHP 8.4.26, later expanding support to selected 8.4 and 8.5 builds.
Google’s John Hultquist called the threat:
“viable and very serious.”
— John Hultquist, Google, quoted by The Record.
Why a DDoS botnet worries hosting and crypto operators
The wider threat is already substantial. Cloudflare recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026.
Those attacks were not attributed to Potassium. Still, they illustrate the disruption facing hosting providers, payment processors and crypto platforms. No financial losses have been linked to PHP2Shell.
PHP’s new advisory and what to watch
On October 23, PHP disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends session.upload_progress.enabled=0, also a mitigation for CVE-2026-109619.
Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers and monitor suspicious downloads.
Cobalt CISO Andrew Obadiaru warned that this quiet period is:
“borrowed time.”
— Andrew Obadiaru, Cobalt, quoted by The Record.
Attackers are trying to turn vulnerable PHP servers into Potassium bots, part of a Mirai-derived network designed for distributed denial-of-service (DDoS) attacks. But so far, they have struggled. The Hacker News reported on October 23 that no server compromises had been confirmed.
There were two major PHP vulnerabilities that were the main targets of the cyber attacks – CVE-2026-109618 and CVE-2026-109619, both of which received 9.2 out of 10 scores in terms of severity. PHP made the patches available on October 21, but by that time hackers had already started launching attacks against these vulnerabilities.
What Sophos saw, then walked back
Arctic Wolf reports that attempted command execution and malware downloads have been attributed to Potassium. Another assessment performed in a sandbox environment revealed a different sample that reached out to thunder.godofthunder[.]st through IP 134.199.154[.]64 at TCP port 50792 and attacked two Ukrainian hosts.
It demonstrated the potential of the malware but not that the attackers have breached the production servers. On October 22, Sophos retracted a prior success announcement, saying to The Record that it had only observed unsuccessful attack attempts.
Millions of probes, zero confirmed break-ins
However, the figures do indicate the extent to which attackers are probing. Imperva recorded 482,342 request attempts in 122,311 sessions aimed at 21,998 sites in 103 countries within a 24-hour period.
At the same time, Censys reported detecting over 41 million internet-facing PHP services running versions that were affected and only about 1 million instances of deployment of patched versions of the software by October 22. The numbers reflecting scanning incidents or the number of individuals exposed are insufficient to prove an actual compromise happened.
24 flood commands and a dormant ENS switch
Arctic Wolf has revealed that 24 flood commands include all types of ICMP, TCP, UDP, and Open VPN. There is also the presence of Ethereum Name Service (ENS) lookup features in both ARM and x86-64 Potassium versions, but this has been turned off in both instances.
Ethereum and ENS have not been compromised. However, activating the ENS lookup features can lead to a more difficult way of blocking command servers with any use of conventional DNS and IP controls.
Garbage PoCs versus a working private exploit
Many public proof-of-concept (PoC) exploits fail against production defenses, particularly address space layout randomization (ASLR). VulnCheck’s Spencer McIntyre described many circulating samples as:
“garbage and nonfunctional.”
— Spencer McIntyre, VulnCheck, quoted by The Record.
That protection is not foolproof. VulnCheck developed a private exploit bypassing ASLR on production-configured PHP 8.4.26, later expanding support to selected 8.4 and 8.5 builds.
Google’s John Hultquist called the threat:
“viable and very serious.”
— John Hultquist, Google, quoted by The Record.
Why a DDoS botnet worries hosting and crypto operators
The wider threat is already substantial. Cloudflare recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026.
Those attacks were not attributed to Potassium. Still, they illustrate the disruption facing hosting providers, payment processors and crypto platforms. No financial losses have been linked to PHP2Shell.
PHP’s new advisory and what to watch
On October 23, PHP disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends session.upload_progress.enabled=0, also a mitigation for CVE-2026-109619.
Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers and monitor suspicious downloads.
Cobalt CISO Andrew Obadiaru warned that this quiet period is:
“borrowed time.”
— Andrew Obadiaru, Cobalt, quoted by The Record.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.
FAQs
What is Potassium?
Potassium is a Mirai-derived botnet variant first flagged by Synthient in March 2026, which Sophos says now carries downloader and network-disruption code and can run DDoS attacks over protocols including ICMP, TCP, UDP and OpenVPN.
Has any server actually been compromised through PHP2Shell?
No. Sophos retracted an earlier claim of successful exploitation on October 22, and Google, VulnCheck and other researchers say they have seen attempts but no confirmed successful remote code execution.
Which PHP versions fix the flaws?
PHP released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and administrators are urged to patch internet-facing systems first and verify their web-server processes run the patched runtime.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Micah Abiodun
Micah Abiodun makes good use of his Environmental Engineering and Management (MSc) at Tallinn University of Technology (TalTech) to polish content and price prediction news at Cryptopolitan. Now on his 7th year in the crypto media space, he covers major cryptos, altcoins, DeFi, stablecoins, macro trends, and emerging tech.
