PHP2Shell RCE Probes Hit Millions but Fail to Weaponize for Potassium Mirai Variant

Attack telemetry shows the loader performing DNS resolution for thunder.godofthunder.st with fallback to 8.8.8.8 and 1.1.1.1, then validating ELF payloads before enabling ICMP/TCP/UDP/OpenVPN floods against Ukrainian hosts 45.88.138.0/44. The variant incorporates ChaCha20 config encryption and ENS resolution stubs first noted by Nokia Deepfield in March 2026, yet remains inactive. SOCRadar scanning scripts on 206.188.197.105 confirm attackers are still probing PHP version and session preconditions rather than achieving RCE.

Evidence from Sophos and Arctic Wolf sandboxes reveals 24 flood commands and named reverse-shell protocol SHELL/SHOUT on the attack channel, indicating incremental Mirai fork evolution rather than novel capability. The absence of working PHP2Shell payloads despite public tooling suggests actor groups lack reliable unauthenticated chains for patched 8.2-8.5 branches, a recurring pattern in low-sophistication botnet campaigns.

Operational significance lies in the persistent reuse of exposed PHP endpoints for initial access even when exploit maturity lags. Next phase will likely involve broader scanning for unpatched instances or fallback to older vulnerabilities while Potassium refines its ENS and DNS misdirection layers to evade registrar takedowns.