{
  "id": 16162660,
  "title": "PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware",
  "url": "https://urgent.news/2026/10/23/php2shell-exploit-attempts-hit-millions-as-attackers-try-to-deploy",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-23T07:40:45.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html"
  },
  "original_language": "en",
  "account": null,
  "summary": "Source: The Hacker News\n\nThreat actors have been attempting to exploit the recently disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to deploy a modified version of the Mirai botnet, called Potassium. These vulnerabilities, present in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, allow for unauthenticated remote code execution (RCE) via specially crafted HTTP requests. However, the attacks have been unsuccessful so far, as the exploit attempts are harder than previously thought. The Potassium botnet variant, which has expanded functionality compared to its predecessor, can resolve hard-coded encrypted command-and-control (C2) addresses, establish TCP connections, and send HTTP requests to check for a specific response status. The malware also supports IPv4 addresses and hostname resolution, as well as fallback resolution logic using public DNS servers. The primary goal of the Potassium botnet is to execute DDoS attacks against two adjacent hosts within a single Ukrainian network.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}