PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

Key Points:

• Threat actors have attempted to exploit the newly disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to recruit systems into the Potassium Mirai botnet variant, but successful exploitation appears difficult, with no confirmed remote code execution reported so far.
• The Potassium botnet, an evolved Mirai variant, uses advanced techniques including encrypted command-and-control communication, supports multiple attack protocols, and can launch DDoS attacks; it also features disabled Ethereum Name Service (ENS) resolution that could complicate future mitigation efforts.
• Exploit tooling for PHP2Shell targeting PHP 8.4.26 has been found on attacker-controlled servers, including scripts that scan websites for vulnerable configurations, but no evidence of successful shell access has been observed, indicating many targets do not meet exploit prerequisites.
• A novel exploit technique has been developed to bypass Address Space Layout Randomization (ASLR) protections on production-configured PHP systems, demonstrating that a key security barrier can be overcome, raising concerns about potential future successful attacks.
• Despite widespread scanning and exploitation attempts immediately after vulnerability disclosure, the PHP2Shell flaws have led to precautionary shutdowns affecting government, school, and hospital websites globally, with millions of PHP services still vulnerable due to unpatched older PHP versions.