PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
AI Summary
Threat actors are actively attempting to exploit the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to deploy a Mirai botnet variant called Potassium. Despite millions of exploit attempts observed globally, no successful remote code execution has been confirmed, suggesting attackers are struggling to reliably weaponize the flaws. The attacks involve scanning, fingerprinting, and payload delivery attempts using infrastructure tied to multiple IP addresses and a C2 server at 134.199.154[.]64. The Potassium malware is designed to conduct DDoS attacks and includes advanced features such as ENS-based C2 resolution and ChaCha20-encrypted configuration. A Python-based 'one-click' exploit tool named aslr_exploit.py has been found on an attacker-controlled server, indicating ongoing development of reliable exploitation methods.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 33 extracted
| Type | Value | Detail |
|---|---|---|
| IP | 134[.]199[.]154[.]64 | Details → |
| IP | 85[.]11[.]167[.]243 | Details → |
| IP | 217[.]60[.]242[.]76 | Details → |
| IP | 45[.]198[.]224[.]169 | Details → |
| IP | 92[.]118[.]112[.]100 | Details → |
| IP | 206[.]188[.]197[.]105 | Details → |
| IP | 102[.]210[.]149[.]166 | Details → |
| IP | 122[.]10[.]110[.]72 | Details → |
| IP | 122[.]10[.]17[.]49 | Details → |
| IP | 58[.]221[.]60[.]160 | Details → |
| IP | 41[.]223[.]30[.]7 | Details → |
| IP | 157[.]230[.]117[.]70 | Details → |
| IP | 104[.]219[.]251[.]31 | Details → |
| IP | 107[.]150[.]31[.]151 | Details → |
| IP | 217[.]160[.]132[.]82 | Details → |
| IP | 47[.]100[.]125[.]108 | Details → |
| IP | 54[.]169[.]109[.]7 | Details → |
| IP | 139[.]162[.]165[.]136 | Details → |
| IP | 87[.]121[.]84[.]174 | Details → |
| IP | 181[.]215[.]186[.]252 | Details → |
| IP | 185[.]196[.]220[.]132 | Details → |
| IP | 185[.]161[.]210[.]29 | Details → |
| IP | 152[.]233[.]51[.]69 | Details → |
| IP | 45[.]134[.]225[.]16 | Details → |
| IP | 107[.]189[.]14[.]87 | Details → |
| IP | 193[.]47[.]62[.]24 | Details → |
| IP | 103[.]147[.]220[.]17 | Details → |
| IP | 2409:40d2:204e:4be:2a1f:f9c9:a055:e00b | Details → |
| Domain | thunder[.]godofthunder[.]st | Details → |
| Filename | aslr_exploit.py | Details → |
| Filename | php2shell_fp.py | Details → |
| Filename | deep_probe.py | Details → |
| Filename | wp_attack.py | Details → |