[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUT3wLw9eL7L-rz0gXwlmhDZJwVlpe1A3Tbm2bPT8kRI":3},{"article":4,"iocs":45,"watch_terms":52,"solutions":53,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"afc7bc76-afd9-4a6a-b018-e5ece8b398a1","Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge","mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge-8915ec","Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet. The post Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge appeared first on SecurityWeek.","Threat actors are attempting to leverage newly discovered PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) to spread a Mirai botnet variant called Potassium. While exploitation attempts have surged, no successful compromises have been confirmed, with researchers suggesting attackers are struggling to overcome exploit complexities and memory protection bypasses like ASLR.","Mirai botnet operators exploit PHP2Shell vulnerabilities, but no successful compromise confirmed.","https:\u002F\u002Fwww.securityweek.com\u002Fmirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F06\u002FPHP.jpeg","2026-10-23T12:45:52+00:00","2026-10-23T13:00:18.41898+00:00",8,[17,20],{"name":18,"type":19},"PHP","technology",{"name":21,"type":19},"ASLR","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":22,"icon":24,"name":25,"slug":26},null,"Malware","malware",[28,33,38,40],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":34},{"id":35,"icon":24,"name":36,"slug":37},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":39},{"id":22,"icon":24,"name":25,"slug":26},{"category":41},{"id":42,"icon":24,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,50],{"type":47,"value":48,"context":49},"cve","CVE-2026-109618","PHP2Shell vulnerability",{"type":47,"value":51,"context":49},"CVE-2026-109619",[],{"controls":54,"vendors":141},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":85,"name":86,"problem":87,"products":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":44,"name":114,"problem":115,"products":116},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[142,148,153],{"slug":143,"name":144,"logo_path":145,"roles":146},"arctic-wolf","Arctic Wolf","\u002Fvendor-logos\u002Farctic-wolf.png",[147],"reported_by",{"slug":149,"name":150,"logo_path":151,"roles":152},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png",[147],{"slug":154,"name":155,"logo_path":156,"roles":157},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png",[147],{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":170},"mirai-variant-targets-php2shell-flaws-before-patches-are-widely-applied","Mirai Variant Targets PHP2Shell Flaws Before Patches Are Widely Applied","Threat actors are actively attempting to exploit two newly disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to deploy a Mirai botnet variant called Potassium, targeting internet-facing systems running vulnerable PHP installations. Although no successful compromises have been confirmed yet — partly due to exploit complexity and memory protections like ASLR — the window of opportunity is narrow and closes only when patches are applied. This incident illustrates the classic race between attacker exploitation and defender remediation, where delayed patching of publicly disclosed vulnerabilities dramatically increases risk. The involvement of an established botnet operation like Mirai underscores that even partially weaponized exploits can cause widespread harm once barriers are overcome, making proactive patch deployment critical.",[163,164,165,166,167,168,169],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":171,"PCI DSS Requirement 6":172,"MITRE ATT&CK T1566: Phishing":173,"NIST SP 800-53 SI-2: Flaw Remediation":174,"OWASP A06:2021 Vulnerable and Outdated Components":175,"CIS Control 7: Continuous Vulnerability Management":176,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":177},"NIS2 requires essential and important entities to implement incident handling and vulnerability management measures, including timely patching of exploitable flaws in internet-facing services like PHP2Shell.","Requirement 6 mandates that organisations protect systems and software from known vulnerabilities through timely patching and secure development practices, which would have directly mitigated exposure to these PHP2Shell CVEs on any cardholder-data-adjacent infrastructure.","While direct exploitation is the primary vector here, Mirai botnets also leverage compromised credential reuse and initial access techniques; mapping to ATT&CK helps defenders build detection rules covering the full kill chain used by Potassium operators.","SI-2 requires organisations to identify, report, and correct information system flaws within defined timeframes — a formal flaw remediation process would have prioritised these CVEs for emergency patching before exploitation attempts surged.","PHP2Shell represents exactly the class of risk OWASP A06 warns against — running components with known vulnerabilities that attackers can target at scale, making component version management and rapid patching essential.","Regular automated scanning and a structured patching cadence would have identified the PHP2Shell flaws promptly and enforced remediation before Mirai operators could successfully weaponise them.","This control mandates timely identification and remediation of technical vulnerabilities in information systems, directly addressing the need to patch PHP2Shell before botnet actors could exploit the disclosed CVEs."]