Mirai Botnet operators join PHP2Shell attacks as exploits emerge

PHP2Shell: PHP2Shell is the collective name for two critical remote code execution vulnerabilities in PHP (tracked as CVE-2026-109618 and CVE-2026-109619) that affect a wide range of versions and enable unauthenticated attackers to execute code on web servers. The flaws were publicly disclosed and patched in late October 2026, triggering immediate scanning and exploit development. In the reported events, these vulnerabilities have drawn Mirai botnet operators seeking to expand their reach through ASLR bypass techniques demonstrated in emerging proof-of-concept exploits. Mirai Botnet: Mirai Botnet is a well-known malware family that primarily targets vulnerable Internet of Things devices to build large-scale botnets used for distributed denial-of-service attacks and other malicious operations. Its operators have recently expanded activity by integrating exploits for newly disclosed PHP vulnerabilities into their attack toolkit. In the current news, Mirai operators are observed attempting to leverage PHP2Shell flaws to deploy updated variants of the botnet malware on compromised web servers. Exploit Development: Security researchers rapidly created the first known ASLR bypass exploit for PHP2Shell targeting production-configured x86-64 PHP servers shortly after patches were issued. Exploitation Activity: Scanning and exploitation attempts against PHP2Shell began days before official disclosure, with Mirai-linked payloads such as the Potassium variant observed in attack traffic. Vulnerability Disclosure: The PHP Foundation released patches for the two PHP2Shell vulnerabilities on October 21, 2026, following early leaks of technical details.