🔴 Critical: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

[XploitLK-Bot]

Threat actors have been attempting to exploit the newly disclosed PHP2Shell vulnerabilities in an effort to recruit infected systems into a Mirai botnet variant known as Potassium. According to reporting, these attempts have so far been unsuccessful, and it appears that weaponizing the flaws may be more difficult than initially assumed.

The attacks target CVE-2026-109618 and CVE-2026-109619, both of which carry a CVSS score of 9.2. These vulnerabilities can result in unauthenticated remote exploitation, which explains the high volume of exploit attempts observed against exposed systems.

Key points for defenders:

• The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS scale.
• Exploitation attempts are widespread, but current efforts to deploy the Potassium Mirai variant have not succeeded.
• The difficulty of reliably weaponizing the flaws may be limiting attackers' success for now.
• Despite failed attempts, the high severity rating and automated scanning activity mean exposed systems should still be treated as at risk.

Organizations running affected PHP deployments should prioritize patching and monitor for exploit attempts targeting these vulnerabilities, as botnet operators continue to probe for weaknesses at scale.

Source: [email protected] (The Hacker News)

Has your organization seen scanning or exploitation attempts targeting these PHP2Shell flaws, and how are you handling mitigation?