Mirai operators attempt PHP2Shell attacks; no confirmed compromises
Original title: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
PHP fixed CVE-2026-109618 and CVE-2026-109619 on October 21; firms say attempts have not produced a confirmed breach.
Two days after PHP emergency-patched PHP2Shell, Sophos, Hunt.io and Arctic Wolf reported attempts to use the flaws to spread Potassium, described as a Mirai variant. Analyzed attempts were stopped or did not show the malware running, and no successful compromise has been confirmed. VulnCheck says it has an ASLR-bypass exploit for CVE-2026-109618 on production-like x86-64 setups, while SOCRadar and Hunt.io found attacker tooling that failed against screened targets. Qualys says most observed PHP instances were still unpatched or on end-of-life branches.
Unconfirmed: Exploitation attempts are reported, but Sophos, Hunt.io, Wordfence and SOCRadar say no successful compromise has been confirmed.
- Fixed PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Each bug has a CVSS v4.0 score of 9.2.
- UK government said 32 services were unavailable, mostly while patches were applied.
- Qualys says about 71% of instances run end-of-life PHP 5.4 through 8.1.
- CISA had not added either CVE to KEV as of the morning of October 23.
Impact: unauthenticated remote code execution in the PHP engine
| Product | Affected | Fixed in |
|---|---|---|
| PHP | — | 8.5.12, 8.4.27, 8.3.36 and 8.2.35 |
- 1.Upgrade supported PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- 2.Treat PHP 5.4 through 8.1 as unpatched because those branches are end of life.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1105 Ingress Tool TransferT1498 Network Denial of Service
- Vendors
- PHP
- Countries
- United Kingdom
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 |
From the original article
4 min read at securityweek.com
Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet. The post Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.