Threat actors have attempted to exploit two PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to spread a Mirai-based botnet. The attacks began shortly after PHP released emergency security updates on October 21.
The flaws allow unauthenticated remote code execution. PHP has released patches for versions 8.5, 8.4, 8.3 and 8.2.
Security firm Sophos detected attempts to exploit the vulnerabilities to install Potassium, a Mirai-derived variant capable of launching distributed denial-of-service (DDoS) attacks and downloading additional malware. However, the analyzed attack was blocked before the malware reached the targeted system.
Arctic Wolf linked two Potassium malware binaries to servers hosting PHP2Shell payloads. However, the company said its telemetry did not show PHP2Shell requests downloading or executing the malware.
Cybersecurity firm Hunt.io attributed the PHP2Shell traffic it observed to a Mirai-style botnet that has been active since at least May 2026. The group appears to have recently added the PHP2Shell vulnerabilities to its delivery arsenal.
Researchers at SOCRadar discovered exploit tools on an exposed attacker-controlled server. The files included an exploit chain and scripts designed to identify vulnerable websites. However, tests against around 20 websites in countries including the US, UK, Canada, France, Finland, Poland and China, found no systems that met the exploit's requirements.
Despite growing attack activity and increased efforts by threat actors, no successful real-world compromise through PHP2Shell has been confirmed so far. That being said, organizations are strongly recommended to install the available updates and monitor systems for suspicious activity.