Public PHP2Shell exploit code used in failed Potassium botnet attempts
Sophos found scanning and failed attempts, not a confirmed compromise; PHP fixed the flaws on October 21.
78
Malware
Potassium
- Mentions · 7d6
- Mentions · 30d6
- All mentions6
- First seenOct 23, 2026
- Last mentioned2d ago
Timeline
6 articles · newest firstMirai operators attempt PHP2Shell attacks; no confirmed compromises
PHP fixed CVE-2026-109618 and CVE-2026-109619 on October 21; firms say attempts have not produced a confirmed breach.
84
PHP2Shell draws millions of attempts; no confirmed RCE yet
Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while Censys still counts over 34.4 million vulnerable services.
88
PoC for critical PHP RCEs draws scans; Sophos sees no confirmed compromises
Sophos revised an earlier alert: telemetry showed scans and failed attempts, not successful compromises of CVE-2026-109618 or CVE-2026-109619.
78
PHP2Shell exploit attempts try to deploy Potassium Mirai
Sophos says the attempts failed, while SOCRadar found exploit tooling aimed at PHP 8.4.26.
74
PHP2Shell exploit attempts rise, but experts doubt they succeed
Amazon and others report scans since October 17, while researchers say public PoCs fail on typical PHP setups.
74
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-10961812%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- Miraimalware · 6
- Sophosorganization · 6
- PHPvendor · 4
- Arctic Wolforganization · 4
- VulnCheckorganization · 3
- PHPproduct · 2
- Amazonorganization · 2
- SOCRadarorganization · 2
- Cloudflareorganization · 2
- Censysorganization · 2
- Expelorganization · 1
- CISAorganization · 1
- OpenAIorganization · 1
- Hunt.ioorganization · 1
- Wizorganization · 1
- Dutch National Cyber Security Centreorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.