PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote
Source: The Hacker News
Threat actors have been attempting to exploit the recently disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to deploy a modified version of the Mirai botnet, called Potassium. These vulnerabilities, present in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, allow for unauthenticated remote code execution (RCE) via specially crafted HTTP requests.
However, the attacks have been unsuccessful so far, as the exploit attempts are harder than previously thought. The Potassium botnet variant, which has expanded functionality compared to its predecessor, can resolve hard-coded encrypted command-and-control (C2) addresses, establish TCP connections, and send HTTP requests to check for a specific response status.
The malware also supports IPv4 addresses and hostname resolution, as well as fallback resolution logic using public DNS servers. The primary goal of the Potassium botnet is to execute DDoS attacks against two adjacent hosts within a single Ukrainian network.
Brief written by urgent.news from The Hacker News's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
