Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware

Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), allowing unauthenticated remote code execution, were quickly weaponized after proof-of-concept exploit code was made publicly available. Attackers wasted no time attempting to deploy a Mirai-variant botnet (Potassium) against unpatched internet-facing PHP systems. The window between public PoC release and active exploitation attempts was extremely short, highlighting that once exploit code is public, organizations have little time to react. While no successful compromises were confirmed in this instance, the incident underscores the critical importance of proactive patch management and continuous vulnerability monitoring for externally exposed services.