Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

Threat actors are actively attempting to exploit two newly disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to deploy a Mirai botnet variant called Potassium, targeting internet-facing systems running vulnerable PHP installations. Although no successful compromises have been confirmed yet — partly due to exploit complexity and memory protections like ASLR — the window of opportunity is narrow and closes only when patches are applied. This incident illustrates the classic race between attacker exploitation and defender remediation, where delayed patching of publicly disclosed vulnerabilities dramatically increases risk. The involvement of an established botnet operation like Mirai underscores that even partially weaponized exploits can cause widespread harm once barriers are overcome, making proactive patch deployment critical.