Affected Systems

PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) enable unauthenticated remote code execution via crafted HTTP requests. Exploitation attempts target Apache mod_php deployments with specific session configurations.

Exploitation Status

Active exploitation attempts observed in the wild targeting millions of systems. PoC exploit code (aslr_exploit.py) discovered on attacker infrastructure (206.188.197[.]105:9999). No confirmed successful compromises as of October 22, 2026. Threat actors struggling to develop reliable exploits due to complex preconditions including ASLR bypass requirements.

Business Impact

Widespread scanning and exploitation attempts detected from multiple source IPs (85.11.167[.]243, 217.60.242[.]76, 45.198.224[.]169). Goal is deployment of Potassium Mirai botnet variant for DDoS attacks. Malware supports 24 flood attack commands across ICMP, TCP, UDP, and OpenVPN protocols. Observed C2 infrastructure at 134.199.154[.]64 targeting Ukrainian networks. Exploitation complexity appears high, requiring specific Apache mod_php configurations and session upload progress handling. Organizations running unpatched PHP with Apache mod_php face elevated risk despite low observed success rate.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Upgrade PHP immediately to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 depending on your branch
  • Block outbound connections to known malicious IPs: 85.11.167[.]243, 217.60.242[.]76, 45.198.224[.]169, 92.118.112[.]100, 134.199.154[.]64, and domain thunder.godofthunder[.]st
  • Monitor web server logs for unusual HTTP requests targeting PHP session handling, particularly session upload progress abuse and suspicious User-Agent patterns
  • Review Apache mod_php configurations and disable session.upload_progress if not required for business operations
  • Deploy network-based detection for DNS queries to thunder.godofthunder[.]st and TCP connections to port 50792 associated with Potassium C2 activity