PHP2Shell Now Carries a Mirai Botnet, and PHP Disclosed a Third Bug It Won't Rush. 27 Attack Indicators Are in Our Feed Tonight.
If you run PHP and have not patched since Tuesday, do two things today. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Then set session.upload_progress.enabled to 0 in php.ini, because that one setting also closes a third bug PHP disclosed this morning and has not fixed yet.
Two days into PHP2Shell, the attacks have a payload with a name, and we have put the addresses behind it into our feed.
What changed since Tuesday
The payload. Attackers are using PHP2Shell to install Potassium, a fork of the Mirai botnet that the research firm Synthient first flagged in March. Sophos analyzed samples that connect to thunder.godofthunder.st, which resolves to 134.199.154.64, over TCP port 50792. Arctic Wolf counted 24 flood commands in it. The samples were aimed at a Ukrainian network.
The volume. Cloudflare reported attempts in the tens of thousands 45 minutes after PHP's advisory and in the millions by early October 22. Amazon says its honeypots logged an attempt on October 17, four days before anyone disclosed the bugs.
The success rate, so far. This part is easy to miss. SOCRadar screened about 20 targeted sites and found no shell access on any of them. Hunt.io found 123 targeted servers, about 57 of them running PHP, and none exploited. Millions of attempts and few confirmed break-ins means the spray is cheap. It does not mean you are safe unpatched.
The third bug. PHP published CVE-2026-115560 on October 23 as an informational advisory with no severity score and no emergency release. It applies only to an application that sets session.serialize_handler to php_binary or php_serialize, switches it to php at runtime before session_start(), and leaves session upload progress on. PHP calls that setup unlikely. The workaround is the one many people already applied for CVE-2026-109619: session.upload_progress.enabled = 0. If you did that on Tuesday, you are done.
What is in our feed
We ingested 27 indicators tonight under the source manual-batch-php2shell-potassium, each verified by reading it back. All of it is third-party research, cited, not our observation.
Confidence 85: the Potassium C2 address and domain (Sophos) and the loader server the attack sources called (Cowrai).
Confidence 80: three attack sources (Cowrai) and the exploit tooling server SOCRadar found.
Confidence 75: eight exploit-attempt sources Wordfence published.
Confidence 60: twelve open directories Hunt.io found holding PHP2Shell tooling. These are often rented or hijacked cloud boxes, so they sit below our own edge shield's blocking floor of 80.
Default subscribers to ips.csv get all of it, because that file's default floor is 50. Pull with min_confidence=80 and you get only the C2, the loader and the confirmed attack sources.
ThreatFox had the C2 before us: it listed 134.199.154.64 on port 50792, the one Sophos named, at 15:43 UTC on October 22, along with the C2 domain. Credit where it is due. Two of the Wordfence attempt sources sit inside /24 ranges we added to the feed on June 14 as bulletproof hosting. That is block coverage of the range, not a detection of these addresses.
One of Wordfence's attempt sources was already in our feed from our own edge honeypot: 87.121.84.174 tripped our .env decoys on October 5, sixteen days before PHP2Shell was public. That is our receipt, but it is a receipt for credential-file scanning, not for this exploit.
What we left out, and why: the two Ukrainian addresses Potassium was told to flood (they are victims), the public DNS resolvers it falls back to (1.1.1.1 and 8.8.8.8 are not malicious), and one attempt source that is a Tor exit relay, which would block every Tor user who shares it.
What our edge saw
Our edge recorded 13 requests since October 14 that match PHP recon paths, mostly curl hitting Symfony profiler phpinfo pages. None match the PHP2Shell exploit itself. That is inventory scanning, not exploitation, and we are not a large PHP target, so a quiet edge here says little about yours.
If this was useful, or if it wasn't, the rating widget below takes ten seconds and is the only way we know.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=php2shell-now-carries-a-mirai-botnet-and-php-disclosed-a-third-bug-it-won-t-rush-27-attack-indicat
Comments