PHP2Shell Escalates: Millions of Exploitation Attempts, Mirai Deployment Attempts, and a Confirmed Government Breach Over the Weekend (CVE-2026-109618 / CVE-2026-109619)

Scope: PHP versions 5.4 through 8.5, patched in 8.5.12, 8.4.27, 8.3.36, and 8.2.35

Severity: Red

We flagged PHP2Shell last week as the patch shipped and early exploitation attempts emerged within minutes. Over the weekend, the situation escalated sharply. Previdian’s telemetry recorded hundreds of exploitation attempts against CVE-2026-109618 from dozens of unique IP addresses, with the first confirmed event on October 21 at 1:05pm. SOCRadar found a complete exploit toolkit on an attacker-controlled server, including a Python script the operator labelled a “one-click” exploit for PHP 8.4.26 under Apache mod_php, alongside screening scripts checking live sites for the preconditions the attack chain depends on, with attackers attempting to deploy Mirai botnet malware onto compromised hosts. Palo Alto Networks Unit 42 initially linked PHP2Shell exploitation to a breach at a European government agency where attackers accessed MFA secrets and password hashes, with signs pointing to agentic AI tooling used in post-exploitation, though Unit 42 later walked back the specific attribution to these CVEs while confirming the broader attack activity. As of October 23, more than 34.4 million PHP services were still assessed as vulnerable, and neither CVE has yet appeared on CISA’s Known Exploited Vulnerabilities catalog despite the confirmed exploitation. Organisations running PHP must update to the fixed version for their branch today if this has not already happened, and should treat any system that was internet-facing and unpatched since October 20 as a potential compromise requiring credential rotation and log review, not simply a patching task to tick off.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.