Attackers Try to Exploit PHP2Shell Flaws to Deploy Mirai Variant, With Attempts Largely Failing

Summary

Threat actors have been observed unsuccessfully trying to exploit the newly disclosed PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS scores 9.2), in an effort to enlist infected systems in a Mirai botnet variant called Potassium. The reporting says exploit attempts have reached millions, and that weaponizing the flaws may be harder than previously thought.

Timeline

1. The Hacker News

   23 Oct 2026, 07:40 UTCSource ↗

   Reports that threat actors have unsuccessfully attempted to exploit the newly disclosed PHP2Shell flaws to rope systems into a Mirai botnet variant called Potassium, that exploit attempts have reached millions, and that weaponizing the flaws may be harder than previously thought.