PHP2Shell 48 Hours Later: Mirai, Palo Alto and a New CVE

Two days after PHP shipped emergency fixes for CVE-2026-109618 and CVE-2026-109619, the aftershocks arrived. Mirai botnet operators tried the flaws, Palo Alto Networks confirmed PAN-OS, Panorama and WildFire are affected, PHP disclosed a new session flaw CVE-2026-115560 that needs no emergency patch, and Unit 42 confirmed a real compromise at a European government entity. Scanning jumped from thousands to millions within hours of disclosure.

The details here come from Unit 42 updates on 23 October 2026, Palo Alto Networks advisory PAN-SA-2026-0008, the PHP advisory for CVE-2026-115560 on 23 October, SecurityWeek and BleepingComputer coverage on 23 October, and Cloudflare and Amazon honeypot data.

What happened in the first 48 hours?

PHP still powers roughly 70 percent of websites. Governments from the US and UK to Japan took services offline. The NSA issued an alert to patch immediately. That is why the same CVEs now appear in vendor advisories outside web hosting.

Why does a new CVE not mean a new emergency patch?

On 23 October the PHP team disclosed CVE-2026-115560, a new PHP session vulnerability tied to session upload_progress. The flaw affects fully patched releases, including 8.5.12, and will be fixed in the next regular release. PHP will not issue an out of band release for it.

According to the PHP advisory, the flaw affects only an unusual upload_progress configuration and is unlikely. Mitigation is to disable upload_progress as described in the advisory. I have run hosts where upload_progress was never enabled, so the new vector did not apply.

How did botnets and vendors react?

SecurityWeek reported on 23 October that Mirai botnet operators joined PHP2Shell attacks as ASLR bypass exploits emerged, but researchers tied attempts to a Mirai variant called Potassium and showed no successful compromise yet. That distinction matters. Attempts do not equal takeover, but Mirai's interest means the flaws are now in commodity scanning.

Palo Alto Networks confirmed on 23 October that PHP2Shell affects PAN-OS and Panorama, and Cisco confirmed its products were affected under cisco-sa-php-october26. If you run PAN-OS, check the Palo Alto advisory for your train.

According to Cloudflare, protections were on by default from 03:02 UTC on 21 October, nine hours before disclosure. Amazon saw the first MadPot honeypot attempt on 17 October, four days before patches.

What did the confirmed compromise look like?

Unit 42 updated its threat brief on 23 October with a confirmed intrusion. Attackers who exploited PHP2Shell at a European government entity reached password hashes and multi factor secrets within two hours, set up an NTLM relay tunnel into Active Directory, and tried to become Domain Admin. The same brief notes Sophos saw the Mirai variant try the bugs.

That two hour window is the signal. The flaws give the web worker account and the next step is the directory. I ran a tabletop on a lab with a PHP front end and Active Directory. The time from worker compromise to recon was minutes once the attacker had the worker. That is why CISA guidance to patch also implies rotating any secrets in the same worker, because CVE-2026-109619 can leak memory without full compromise.

What should you check and patch today?

The checklist has not changed, but the inventory now includes appliances that bundle PHP.

First, patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart workers, then verify worker age. Second, check Palo Alto and Cisco advisories if you run PAN-OS or Cisco products that bundle PHP. Third, apply mitigation for CVE-2026-115560 if you run the unusual upload_progress config. Fourth, review logs for OOM events around 17 October and scanning spikes after 21 October.

The isolation thinking I use at Krova Cloud for agent and build workloads applies to PHP workers. A worker that can run code as the web user should not be shared across trust boundaries, as described in container vs microVM isolation. The same disposable microVM pattern I use to test PHP upgrades safely is the pattern that limits what a compromised worker can reach.

What is the verdict and what remains uncertain?

According to Unit 42, the first confirmed compromise shows the flaws are not theoretical. According to SecurityWeek, the Mirai attempts have not shown confirmed success, but the presence of botnets means scanning will continue. According to CERT-EU on 23 October, the new CVE-2026-115560 is real but narrow, and the immediate priority remains the two PHP2Shell flaws.

The verdict is to treat PHP2Shell as now broadly exploited in the wild, even if the only confirmed intrusion is a single European government entity so far. The flaws are in the interpreter, they affect roughly 70 percent of sites, and appliances that bundle PHP extend that surface.

The limitations are threefold. First, CVE-2026-115560 will remain unpatched until the next regular PHP release, so mitigation is the only option for that narrow vector. Second, many hosts on PHP 8.1 and earlier have no official binary fix and must migrate. Third, edge WAF rules deployed by Cloudflare and others help but do not fix the interpreter. An attacker who reaches the origin directly bypasses the edge.

FAQ

Is my site safe if I patched on 21 October?

For PHP2Shell, yes, after patch plus worker restart. For CVE-2026-115560, check whether you run the unusual session upload_progress configuration. If you do, apply the mitigation even though you are on 8.5.12.

Do I need to patch PAN-OS separately?

Yes. PAN-OS bundles PHP. Follow the Palo Alto Networks advisory for your PAN-OS train. Updating the system PHP package does not patch the appliance.

Did anyone get Domain Admin through PHP2Shell?

Unit 42 says attackers at one European government entity tried to escalate to Domain Admin after reaching hashes and MFA secrets within two hours. The brief does not confirm they succeeded.

Published on debugly.dev by Rohit Bhadani | Founder of Krova Cloud

Published on debugly.dev by Rohit Bhadani | Founder of Krova Cloud