Attackers Try PHP2Shell Exploits to Build Mirai Botnet, Without Success So Far
Threat actors have been attempting to exploit the newly disclosed PHP2Shell flaws to enroll systems in a Mirai variant called Potassium, but the attempts have not worked, and weaponizing the bugs may be harder than first thought.
Threat actors have been trying to exploit the newly disclosed PHP2Shell vulnerabilities to add infected systems to a Mirai botnet variant called Potassium, according to reporting from The Hacker News. The attempts have been unsuccessful, and the report says weaponizing the flaws may be harder than previously thought.
The attacks target two PHP flaws, tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS 4.0 by the PHP project. According to the vendor advisories, both can lead to unauthenticated remote code execution.
The first involves PHP's use of longjmp() to exit the current context on out-of-memory errors. Some contexts may not account for that path and can leave request memory uninitialized before an allocation, which request cleanup may then read or branch on. The second concerns global state that temporarily points into request memory and may not be reset correctly, or may be repopulated after reset, leaving stale references to freed memory that later requests can read.
The advisories list affected branches as 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12. The retained source does not state a patch status.
For defenders, the practical point is that mass scanning and exploit attempts are already underway even though the reported attacks failed. Inventory internet-facing PHP deployments, confirm which branches and versions you run against the vendor advisory, and watch for botnet-style probing in logs.
CVE references
Sources
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai MalwarePrimarythehackernews.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning