PHP2Shell Scanners Left Their Toolboxes Open, and Hunt.io Looked
Hunt.io combed about ten attacker open directories full of PHP2Shell tooling and a Mirai-style botnet, and published attempt signatures and indicators defenders can search for today.
Some of the people scanning for PHP2Shell left their tool folders open to the internet, and Hunt.io went through them. The threat-intel firm says it found about ten attacker open directories holding PHP2Shell tooling, plus a Mirai-style IoT botnet that has added the bug to its spreading kit. The useful part for defenders is a set of attempt signatures and indicators. Hunt.io is clear that none of the activity it tracked produced a confirmed PHP2Shell compromise, but Amazon has separately said exploitation is now broad, as we covered in our MadPot story.
For defenders
The bugs: CVE-2026-109618 and CVE-2026-109619, PHP memory corruption in out-of-memory handling during multipart request parsing, both CVSS v4.0 9.2. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. No authentication needed. EPSS for CVE-2026-109618 is now about 99.98%; it isn’t in CISA KEV yet, and public exploits are reported in Exploit-DB, Nuclei and more than 650 GitHub repositories. Background is in our patch-day post.
Attempt signatures (attempts, not proof of compromise): multipart POSTs carrying a PHP_SESSION_UPLOAD_PROGRESS field with an oversized body; requests built to exhaust memory, such as missing content length or piles of per-part headers; user-agents containing “php2shell”; and bursts of “Allowed memory size exhausted” in PHP-FPM logs from Oct. 21 on. Hunt.io also shares a scanner JA4H fingerprint from peer reporting. That’s T1595.002 (Active Scanning: Vulnerability Scanning) aimed at T1190 (Exploit Public-Facing Application), with payloads pulled from staging hosts via T1105 (Ingress Tool Transfer).
What the directories showed: one mass-exploitation server ran ten passes against up to 123 targets through roughly 97 proxies and logged no shells. Another operator gave up on PHP2Shell and hit a target list with an unrelated AVideo SQL injection instead. The botnet scanner sits on VPSVAULT (AS215925). Hunt.io counts about 3.19 million IPs showing PHP, but warns that version banners are a poor guide because distros backport fixes.
45.198.224[.]0/24 (scanner network, AS215925)
85.11.167[.]243 (scanner)
92.118.112[.]100 (payload host)
89.32.41[.]16, 89.32.41[.]50, 45.198.224[.]88 (botnet binaries)
*.botlesscucks[.]st, *.godofthunder[.]st, *.gettingheadfromduckysmom[.]st (botnet C2)
maste.mangsud[.]org (payload source in staged shell.php)User-agent contains: php2shell (seen as php2shell-scan/109618, php2shell-109618)
JA4H: po11cn050000_0a87faf13e54_fe81d65a9ab0_0b5a6e5841d5
Staging: 206.188.197[.]105:9999, 58.221.60[.]160:8000, 104.219.251[.]31:8123, 102.210.149[.]166What it means for you
PHP runs a huge share of websites, including most WordPress sites. If someone else hosts your site, the fix is your host’s job, but it’s fair to ask whether they’ve applied it. Seeing these attack attempts in your logs doesn’t mean you’ve been hacked. It means someone knocked. Hunt.io’s data says the knocks are constant right now.
Do this now
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or confirm your distro or host has shipped the backported fix. Anything on 7.x or older needs an upgrade plan.
- If you can’t patch today, turn off
session.upload_progressand put a WAF in front of the site. Hunt.io says neither one fully closes the hole. - Search web and PHP-FPM logs for the signatures above, and block the listed scanner and botnet infrastructure.
CVE at a glance
- CVSS
- 9.2 Critical (v4.0)
- EPSS
- 100% chance of exploitation in the next 30 days (higher than 99.9% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Oct 26, 2026
- Public exploit
- Yes, reported in Exploit-DB, a Nuclei template and 708 GitHub repositories
- CVSS
- 9.2 Critical (v4.0)
- EPSS
- 100% chance of exploitation in the next 30 days (higher than 99.9% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Oct 26, 2026
- Public exploit
- Yes, reported in 24 GitHub repositories
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.