PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

Threat actors are actively attempting to exploit two newly disclosed PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS score of 9.2. The attacks aim to leverage unauthenticated remote code execution to compromise systems and enlist them into a Mirai botnet variant called Potassium. Despite the high volume of exploit attempts reaching millions, attackers have been largely unsuccessful, as weaponizing the flaws appears more difficult than initially anticipated. The vulnerabilities allow unauthenticated remote access, making them high-severity targets for botnet operators. The Mirai-based Potassium variant is the end payload intended for deployment on compromised systems. This campaign highlights the rapid exploitation attempts that follow public disclosure of critical vulnerabilities.