CVE-2026-109618 & CVE-2026-109619: PHP2Shell Exploitation Attempts Deploying Mirai 'Potassium' Botnet — Detection and Remediation Guide

Within days of public disclosure, the newly revealed PHP2Shell vulnerabilities — CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) — have become the target of mass exploitation attempts. Telemetry reported this week shows attack volume reaching into the millions of requests, with threat actors attempting to conscript compromised servers into a Mirai botnet variant tracked as Potassium.

Two facts from the reporting should shape your defensive posture:

1. The exploitation attempts are largely failing so far. Weaponizing these flaws appears harder than initial assessments suggested — exploit reliability is low and many observed attempts never achieve code execution.
2. Volume is not the same as success — but volume will find the soft targets. Any internet-facing PHP stack that is unpatched, misconfigured, or running in a non-default condition that satisfies the exploit prerequisites is one lucky request away from becoming a Potassium node.

Unauthenticated remote code execution at CVSS 9.2 on the world's most widely deployed web scripting platform is not a "wait and see" event. This post breaks down what we know, how the attack chain works, and — most importantly — what to detect, hunt, and remediate today.

Technical Analysis

Affected Products and Severity

How the Attack Works (Defender's View)

While full exploit mechanics are still being reverse-engineered by the research community, the observed campaign follows the classic Mirai recruitment pattern riding on top of the PHP2Shell RCE primitive:

1. Reconnaissance / spray: Automated scanners send crafted HTTP requests to internet-facing PHP endpoints at scale. The reported "millions of attempts" figure reflects indiscriminate internet-wide spraying rather than targeted operations.
2. Exploitation attempt: The request targets the PHP2Shell flaws (CVE-2026-109618 / CVE-2026-109619) to achieve unauthenticated command execution in the context of the web server / PHP-FPM worker process. Per current reporting, the exploit is unreliable — prerequisites around target configuration mean most attempts fail.
3. Download cradle (on success): Successful execution invokes a shell one-liner — typically wget or curl — to pull a shell script or ELF payload from an attacker-controlled host into a writable directory such as /tmp or /dev/shm.
4. Staging and execution: The payload is made executable (chmod +x) and launched. Mirai variants classically fingerprint architecture and fetch per-architecture binaries (x86, ARM, MIPS) — watch for rapid sequential downloads of multiple architecture-specific files.
5. Botnet enrollment: The Potassium binary establishes outbound C2 connectivity, attempts to remove competing malware, and may kill the parent process lineage to detach. Persistence on servers (as opposed to IoT) is often crude: cron entries, modified rc.local, or simply surviving in memory until reboot.
6. Cleanup behavior: Mirai-family payloads frequently delete their on-disk binaries after execution while keeping the process running — the file vanishes but the process persists, which complicates naive file-based detection.

Why Defenders Still Need to Move Fast Despite "Failed" Attempts

Low exploit reliability is a property of the current public exploit code, not of the vulnerability. Historically, exploit maturity curves for mass-sprayed RCEs are measured in days to weeks. The spray-and-pray traffic hammering your perimeter right now is simultaneously: (a) reconnaissance that fingerprints which hosts respond promisingly, and (b) a live-fire test harness improving the exploit. Assume a more reliable weaponized version is coming.

Detection & Response

The highest-fidelity detection opportunity in this campaign is not the exploit request itself (which varies by actor) — it is the post-exploitation behavior, which is consistent across Mirai-family deployments: a PHP/web-server process spawning a shell, which then spawns wget/curl, chmod, and an ELF payload in /tmp or /dev/shm. That parent-child chain should essentially never occur in production.

Sigma Rules

---
title: PHP Web Server Process Spawning Shell or Download Utility
description: Detects php-fpm, php, or web server worker processes spawning shells or download utilities, consistent with post-exploitation of PHP2Shell (CVE-2026-109618 / CVE-2026-109619) RCE attempts delivering the Mirai Potassium botnet.
references:
  - https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/10/09
status: experimental
id: 3f7a2c91-5b8e-4d21-9a64-7c1e0f8b2d33
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/wget'
      - '/curl'
      - '/chmod'
      - '/busybox'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate admin scripts invoked via PHP (exec/shell_exec in management panels); investigate any hit as high priority
level: high
---
title: Mirai-Style Download Cradle to Temp or DevShm Execution
description: Detects download-then-execute cradle patterns (wget/curl piped or followed by chmod +x and execution) targeting /tmp, /var/tmp, or /dev/shm, consistent with Mirai Potassium payload staging after PHP2Shell exploitation.
references:
  - https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/10/09
status: experimental
id: 8b1d4e52-9c37-4f06-b218-6a3d5e0c94f7
logsource:
  category: process_creation
  product: linux
detection:
  selection_cradle:
    CommandLine|contains:
      - 'wget '
      - 'curl '
  selection_path:
    CommandLine|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
  selection_exec:
    CommandLine|contains:
      - 'chmod'
      - '| sh'
      - '|sh'
      - '; ./'
      - '&& ./'
  condition: selection_cradle and selection_path and selection_exec
falsepositives:
  - Legitimate software deployment scripts run by administrators; correlate with parent process and initiating session
level: high
---
title: Deleted ELF Binary Executed from Temp Directory
description: Detects execution of ELF binaries from /tmp, /var/tmp, or /dev/shm where the binary has been deleted after launch (Mirai anti-forensics behavior), or execution of binaries with random short filenames typical of Mirai staging.
references:
  - https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html
  - https://attack.mitre.org/techniques/T1070/004/
author: Security Arsenal
date: 2026/10/09
status: experimental
id: 2c9e6b14-7d48-4a35-8f51-1b6c9d2e73a8
logsource:
  category: process_creation
  product: linux
detection:
  selection_tmp_exec:
    Image|startswith:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
  filter_systemd:
    ParentImage|endswith:
      - '/systemd'
    Image|startswith:
      - '/tmp/systemd-'
  condition: selection_tmp_exec and not filter_systemd
falsepositives:
  - Some installers and monitoring agents execute from /tmp; tune against your software inventory but treat web-server-adjacent hits as critical
level: medium

KQL (Microsoft Sentinel / Defender)

This hunt assumes Linux Syslog/auditd process events are ingested into Sentinel (via the Syslog or CommonSecurityLog connector) or that hosts run Defender for Endpoint (DeviceProcessEvents). It pivots on the PHP-to-shell-to-downloader chain and temp-directory payload staging.

let TempPaths = dynamic(["/tmp/", "/var/tmp/", "/dev/shm/"]);
let WebProcs = dynamic(["php-fpm", "php", "apache2", "httpd", "nginx"]);
let SuspiciousChildren = dynamic(["sh", "bash", "dash", "wget", "curl", "chmod", "busybox", "tftp"]);
union isfuzzy=true
    (DeviceProcessEvents
    | where TimeGenerated > ago(24h)
    | where InitiatingProcessFileName in~ (WebProcs) or ProcessVersionInfoOriginalFileName in~ (WebProcs)
    | where FileName in~ (SuspiciousChildren)
    | extend ChainType = "WebServerSpawnedShellOrDownloader"
    | project TimeGenerated, DeviceName, ChainType, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, RemoteIP, ReportId),
    (Syslog
    | where TimeGenerated > ago(24h)
    | where SyslogMessage has_any (TempPaths)
    | where SyslogMessage has_any (dynamic(["wget", "curl", "chmod +x", "| sh", "|sh"]))
    | extend ChainType = "DownloadCradleToTemp"
    | project TimeGenerated, Computer, ChainType, ProcessName, SyslogMessage, SeverityLevel)
| sort by TimeGenerated desc

A second companion query to find outbound C2-style connections originating from the web server account — a strong Potassium enrollment indicator:

DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessAccountName in~ ("www-data", "apache", "nginx", "nobody")
   or InitiatingProcessFileName in~ ("php-fpm", "php", "apache2", "httpd", "nginx")
| where RemoteIPType == "Public"
| where RemotePort !in (80, 443, 53, 123)
| summarize ConnectionCount = count(), DistinctDestinations = dcount(RemoteIP), Ports = make_set(RemotePort) by DeviceName, InitiatingProcessFileName, RemoteIP
| sort by ConnectionCount desc

Velociraptor VQL

Use this hunt artifact across your Linux web tier to surface (a) web-server-spawned shells/downloaders, (b) executables staged in temp paths, and (c) deleted-but-running binaries — the Mirai anti-forensics signature.

-- Hunt: PHP2Shell / Mirai Potassium post-exploitation artifacts
-- 1) Processes spawned by web/PHP processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(wget|curl|chmod|/tmp/|/dev/shm/)'
  AND Username =~ 'www-data|apache|nginx|nobody'

-- 2) Running processes whose binary has been deleted from disk (Mirai cleanup)
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '\\(deleted\\)'
   OR Exe =~ '^/(tmp|var/tmp|dev/shm)/'

-- 3) Recently created executable files in temp directories
SELECT FullPath, Size, Mtime, Ctime, Mode.String AS Mode
FROM glob(globs=['/tmp/*', '/var/tmp/*', '/dev/shm/*'])
WHERE Mode.String =~ 'x'
  AND Mtime > now() - 86400

Remediation / Verification Script (Bash)

Run this on internet-facing PHP hosts to verify patch state, audit for staging artifacts, and apply compensating hardening. It is read-only by default; the hardening section requires explicit confirmation.

#!/bin/bash
# PHP2Shell (CVE-2026-109618 / CVE-2026-109619) verification & hardening check
# Security Arsenal - run as root or with sudo

echo "=== [1] PHP version check ==="
php -v 2>/dev/null || echo "php CLI not found"
php-fpm -v 2>/dev/null | head -2 || true
# ACTION: Confirm installed version meets or exceeds the fixed release in the
# official PHP advisory for CVE-2026-109618 / CVE-2026-109619.
# If below the fixed version: patch immediately (see Remediation section).

echo "=== [2] Audit temp dirs for staged ELF payloads (last 7 days) ==="
find /tmp /var/tmp /dev/shm -type f -executable -mtime -7 2>/dev/null | while read -r f; do
  file "$f" | grep -q "ELF" && echo "SUSPICIOUS ELF: $f"
done

echo "=== [3] Detect deleted-but-running binaries (Mirai anti-forensics) ==="
ls -l /proc/*/exe 2>/dev/null | grep '(deleted)' || echo "None found"

echo "=== [4] Web-server-spawned shell/downloader audit (last 24h, auditd) ==="
ausearch -ts recent -k exec 2>/dev/null | grep -Ei 'php-fpm|apache2|httpd|nginx' \
  | grep -Ei 'wget|curl|/bin/sh|/bin/bash|chmod' || echo "No auditd hits (or auditd not logging execve)"

echo "=== [5] Cron persistence check for web service accounts ==="
for u in www-data apache nginx nobody; do
  crontab -u "$u" -l 2>/dev/null | grep -v '^#' | grep -q . && echo "CRON ENTRY for $u:" && crontab -u "$u" -l
done
ls -la /etc/cron.d/ /var/spool/cron/ 2>/dev/null

echo "=== [6] Outbound connections from web server processes ==="
ss -tnp 2>/dev/null | grep -Ei 'php-fpm|apache2|httpd|nginx' | grep -v ':80 \|:443 ' || echo "None"

echo "=== [7] Compensating control check: disable dangerous PHP functions ==="
for ini in $(php --ini 2>/dev/null | grep -oP '/[^ ,]+\.ini'); do
  grep -H '^disable_functions' "$ini" 2>/dev/null
done
echo "RECOMMENDED: disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source"

echo "=== Review complete. Any SUSPICIOUS/deleted-binary hits warrant full IR triage. ==="

Remediation

1. Patch immediately. Upgrade PHP to the fixed release addressing CVE-2026-109618 and CVE-2026-109619 per the official advisory at php.net security advisories and your distribution's security channel (e.g., apt upgrade php*, dnf update php*). Do not wait for your normal change window — mass scanning is already underway, and a CVSS 9.2 unauthenticated RCE under active exploitation attempts justifies emergency change procedures.
2. Inventory your exposure. Enumerate every internet-facing host running PHP (mod_php, PHP-FPM, or CGI), including forgotten assets: legacy marketing sites, staging environments, appliance management interfaces, and containers based on PHP base images. Cloud load balancer and WAF logs are your friend for finding what's actually reachable.
3. Apply compensating controls while patching is scheduled:
   • Set disable_functions = exec,passthru,shell_exec,system,proc_open,popen in php.ini on any host whose application does not legitimately require them. This breaks the download-cradle stage of this campaign even if the RCE lands.
   • Restrict outbound egress from web servers: hosts serving web traffic should not be able to reach arbitrary internet destinations on arbitrary ports. Deny-by-default egress is the single most effective control against Mirai-style enrollment.
   • Mount /tmp and /dev/shm with noexec,nosuid where operationally feasible.
4. Deploy a WAF/virtual patch. If you operate a WAF or CDN (ModSecurity, cloud WAF), enable rules blocking the known PHP2Shell exploit request patterns as they are published by vendors. This buys time for hosts you cannot patch immediately.
5. Hunt retroactively. Run the KQL and VQL content above across at least the last 30 days. Given the low success rate of current exploits, a single hit on the web-server-to-shell chain is a strong true-positive signal and should trigger full IR triage: isolate the host, capture memory before reboot (deleted-but-running binaries live only in memory), and preserve /proc/<pid>/ artifacts.
6. Block known Potassium infrastructure. Subscribe to threat intel feeds publishing C2 and payload-hosting IOCs for this campaign and block at the egress proxy/firewall. Treat payload-hosting domains as higher-value blocks than scanner IPs — scanners are disposable, payload infrastructure is reused.
7. Validate monitoring coverage. Confirm your Linux web tier is actually shipping process execution telemetry (auditd/Sysmon-for-Linux/EDR) to your SIEM. The detections above are useless if php-fpm's children are invisible to you.

Bottom Line

The current wave of PHP2Shell exploitation attempts is, by reporting, mostly failing. That is a temporary condition, not a control. The Mirai ecosystem industrializes new RCEs faster than most enterprises patch, and Potassium's operators are already measuring which of your servers respond. Patch the PHP tier, kill shell-spawning capability under the web user, lock down egress, and hunt the post-exploitation chain — those four actions neutralize this campaign regardless of how reliable the exploit becomes.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub