PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

Attackers are actively attempting to exploit newly disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to deploy a Mirai-based botnet variant called Potassium, targeting internet-facing systems at massive scale. The campaign illustrates how quickly threat actors weaponize newly published CVEs, turning disclosed vulnerabilities into live attack infrastructure within a short window. While successful infections appear limited — suggesting the exploit is not trivially easy to weaponize — the sheer volume of attempts underscores the risk to unpatched systems. Organizations that delay applying patches to internet-exposed services give attackers exactly the opportunity they need to compromise assets and conscript them into DDoS botnets.