PHP2Shell attacks surge as Potassium botnet targets vulnerable servers

“viable and very serious.”

— John Hultquist, Google, quoted by The Record.

Why a DDoS botnet worries hosting and crypto operators

The wider threat is already substantial. Cloudflare recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026.

Those attacks were not attributed to Potassium. Still, they illustrate the disruption facing hosting providers, payment processors and crypto platforms. No financial losses have been linked to PHP2Shell.

PHP’s new advisory and what to watch

On October 23, PHP disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends session.upload_progress.enabled=0, also a mitigation for CVE-2026-109619.

Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers and monitor suspicious downloads.

Cobalt CISO Andrew Obadiaru warned that this quiet period is:

“borrowed time.”

— Andrew Obadiaru, Cobalt, quoted by The Record.

“garbage and nonfunctional.”

— Spencer McIntyre, VulnCheck, quoted by The Record.

That protection is not foolproof. VulnCheck developed a private exploit bypassing ASLR on production-configured PHP 8.4.26, later expanding support to selected 8.4 and 8.5 builds.

Google’s John Hultquist called the threat:

“viable and very serious.”

— John Hultquist, Google, quoted by The Record.

Why a DDoS botnet worries hosting and crypto operators

The wider threat is already substantial. Cloudflare recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026.

Those attacks were not attributed to Potassium. Still, they illustrate the disruption facing hosting providers, payment processors and crypto platforms. No financial losses have been linked to PHP2Shell.

PHP’s new advisory and what to watch

On October 23, PHP disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends session.upload_progress.enabled=0, also a mitigation for CVE-2026-109619.

Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers and monitor suspicious downloads.

Cobalt CISO Andrew Obadiaru warned that this quiet period is:

“borrowed time.”

— Andrew Obadiaru, Cobalt, quoted by The Record.

Attackers are trying to turn vulnerable PHP servers into Potassium bots, part of a Mirai-derived network designed for distributed denial-of-service (DDoS) attacks. But so far, they have struggled. The Hacker News reported on October 23 that no server compromises had been confirmed.

There were two major PHP vulnerabilities that were the main targets of the cyber attacks – CVE-2026-109618 and CVE-2026-109619, both of which received 9.2 out of 10 scores in terms of severity. PHP made the patches available on October 21, but by that time hackers had already started launching attacks against these vulnerabilities.

What Sophos saw, then walked back

Arctic Wolf reports that attempted command execution and malware downloads have been attributed to Potassium. Another assessment performed in a sandbox environment revealed a different sample that reached out to thunder.godofthunder[.]st through IP 134.199.154[.]64 at TCP port 50792 and attacked two Ukrainian hosts.

It demonstrated the potential of the malware but not that the attackers have breached the production servers. On October 22, Sophos retracted a prior success announcement, saying to The Record that it had only observed unsuccessful attack attempts.

Millions of probes, zero confirmed break-ins

However, the figures do indicate the extent to which attackers are probing. Imperva recorded 482,342 request attempts in 122,311 sessions aimed at 21,998 sites in 103 countries within a 24-hour period.

At the same time, Censys reported detecting over 41 million internet-facing PHP services running versions that were affected and only about 1 million instances of deployment of patched versions of the software by October 22. The numbers reflecting scanning incidents or the number of individuals exposed are insufficient to prove an actual compromise happened.

24 flood commands and a dormant ENS switch

Arctic Wolf has revealed that 24 flood commands include all types of ICMP, TCP, UDP, and Open VPN. There is also the presence of Ethereum Name Service (ENS) lookup features in both ARM and x86-64 Potassium versions, but this has been turned off in both instances.

Ethereum and ENS have not been compromised. However, activating the ENS lookup features can lead to a more difficult way of blocking command servers with any use of conventional DNS and IP controls.

Garbage PoCs versus a working private exploit

Many public proof-of-concept (PoC) exploits fail against production defenses, particularly address space layout randomization (ASLR). VulnCheck’s Spencer McIntyre described many circulating samples as:

“garbage and nonfunctional.”

— Spencer McIntyre, VulnCheck, quoted by The Record.

That protection is not foolproof. VulnCheck developed a private exploit bypassing ASLR on production-configured PHP 8.4.26, later expanding support to selected 8.4 and 8.5 builds.

Google’s John Hultquist called the threat:

“viable and very serious.”

— John Hultquist, Google, quoted by The Record.

Why a DDoS botnet worries hosting and crypto operators

The wider threat is already substantial. Cloudflare recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026.

Those attacks were not attributed to Potassium. Still, they illustrate the disruption facing hosting providers, payment processors and crypto platforms. No financial losses have been linked to PHP2Shell.

PHP’s new advisory and what to watch

On October 23, PHP disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends session.upload_progress.enabled=0, also a mitigation for CVE-2026-109619.

Administrators should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers and monitor suspicious downloads.

Cobalt CISO Andrew Obadiaru warned that this quiet period is:

“borrowed time.”

— Andrew Obadiaru, Cobalt, quoted by The Record.

The smartest crypto minds already read our newsletter. Want in? Join them.