🪱 php2worm — the PHP worm that mines while it spreads
PHP dropped an 0day today. Every unpatched box on the internet is food.
⚡️ What it does
• Random-scans 0.0.0.0/0 24/7, finds web hosts on 80/443/8080
• Auto-explodes php2shell (CVE-2026-109618/109619) — pre-auth RCE, no auth, no click
• Drops a hidden XMRig rig on every box it catches
• Mines to your own P2Pool node — no pool account, no KYC, payouts every ~2h straight to your
wallet
• Live pwned-host dashboard with per-host callback tracking
🧠 C2 that can't be seized
Commands ride the Ethereum Sepolia testnet as dead-drop calldata. Kill one RPC, it just reads
another. Costs ~nothing, looks like testnet spam.
🛠 Pure Go, single binary, no deps. UAF spray + serializer-mismatch chain C both included. One command, endless hunt