Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

Days after PHP issued emergency patches for the two critical flaws dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, each CVSS 9.2), researchers report that attackers have tried to abuse them to spread a Mirai-derived botnet nicknamed Potassium, though no successful compromise has been verified yet. Sophos, Arctic Wolf and Hunt.io all observed exploitation attempts and related malware traffic but stress that no confirmed breach has occurred, while vendor VulnCheck says it has built a working exploit for CVE-2026-109618 that bypasses ASLR protections on hardened production PHP setups. Separately, SOCRadar and Hunt.io uncovered an exposed attacker server containing custom exploit tooling and scripts that fingerprinted roughly 100+ websites worldwide, finding none matched the specific configuration needed for success. Despite the panic that led some European government and hospital sites to go offline, Qualys data shows patching remains slow, with tens of millions of PHP instances still unpatched or running end-of-life versions.