PoC Exploit Released for Two Critical PHP RCE Vulnerabilities as Hackers Launch Attacks

Public proof-of-concept exploit code targeting two critical PHP vulnerabilities has surfaced as attackers scan exposed servers and attempt exploitation.

Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are collectively called PHP2Shell and carry CVSS v4.0 scores of 9.2, potentially allowing unauthenticated remote code execution with web server privileges.

However, Sophos has corrected an earlier report of successful exploitation. Its October 22 update, published at 21:21 UTC, states that customer telemetry showed scanning and a small number of failed attempts, not confirmed compromises.

The clarification supersedes the company’s 16:18 UTC assessment and materially changes how the observed activity should be interpreted.

Both affect PHP itself rather than a particular application, making the exposure relevant across websites, services, and products embedding vulnerable PHP runtimes.

PHP released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Apache deployments using mod_php face the highest risk, although PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed deployments are also affected.

Administrators must obtain the appropriate upstream release or equivalent vendor package; these updates are not installed automatically.

Sophos Researchers said that, CVE-2026-109618 involves memory corruption associated with out-of-memory handling, while CVE-2026-109619 involves stale request state and use-after-free conditions.

PHP RCE Vulnerabilities

Public exploit availability does not establish reliable exploitation. Sophos said its Adversary Group struggled to develop a successful exploit even with AI assistance.

Claimed researcher successes may depend on laboratory conditions, deployment architecture, specific configurations, or additional dependencies that do not translate consistently into production environments.

The blocked activity involved a payload assessed as Potassium, a likely Mirai-derived botnet variant. Sophos emphasized that the malware was not delivered because its countermeasures prevented the exploitation attempt.

Analysis nevertheless identified an updated, significantly expanded version of the variant documented earlier in 2026.

The sample combines downloader functionality with network disruption capabilities. It resolves a hard-coded, encrypted command-and-control address, opens a TCP connection to 134[.]199[.]154[.]64, and sends an HTTP request.

Before accepting the retrieved content, it checks for an HTTP 200 response and the ELF magic bytes 7F 45 4C 46, indicating an expected Linux executable.

Its resolver supports IPv4 addresses and hostnames, with fallback logic referencing public DNS services 8.8.8.8, 1.1.1.1, and 1.0.0.1. These legitimate resolvers are not malicious indicators themselves.

Like earlier Mirai variants, the sample can conduct distributed denial-of-service attacks. Sophos also associated 117[.]55[.]202[.]115 with Potassium command-and-control infrastructure.

Sophos released Firewall IPS signatures 67359, 67360, 67375, 2313184, 2313185, 2313187, and 2313188. Endpoint IPS coverage includes 2313184, 2313185, 2313187, 2313188, and 2313189.

These protections supplement existing endpoint XDR, Taegis XDR, Windows Behavioral Protection, and Linux Runtime Detection rules, but do not replace patching.

Defenders should examine unexpected multipart upload requests, memory-exhaustion errors, worker crashes, suspicious child processes, modified PHP files, and unusual outbound connections.

When immediate patching isn’t possible, Sophos recommends temporarily removing exposed applications from the internet or placing them behind network-layer authentication.

Configuration mitigations address individual attack paths rather than eliminating the vulnerabilities.

Organizations should inventory active PHP runtimes, including copies bundled with appliances and hosted services, and verify vendor remediation status.

The absence of confirmed compromise in Sophos telemetry should not delay updates: the vulnerabilities remain critical, and attackers may improve exploit reliability as research continues.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.