PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

Security researchers report that the newly disclosed PHP core flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) are being probed at massive scale, with Cloudflare logging millions of exploitation attempts within hours of disclosure. Multiple attackers are trying to leverage the bugs for unauthenticated remote code execution, including efforts to deploy a Mirai-derived botnet called Potassium, but firms like Sophos, Previdian, Wordfence, and Arctic Wolf say no successful compromise or dropped shell has been confirmed so far — largely because PHP's ASLR protections make reliable exploitation difficult. Separately, VulnCheck claims to have built a working exploit chain that bypasses ASLR on x86-64 systems even under PHP's recommended production settings, while SOCRadar found reconnaissance tooling targeting PHP 8.4.26 on an exposed attacker server. The flaws affect PHP going back to version 5.4 and have already prompted precautionary shutdowns of government and hospital sites worldwide; fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, though Censys estimates over 34 million PHP services remain vulnerable.