Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, enable unauthenticated remote code execution with a CVSS v4.0 score of 9.2. Researchers linked exploitation attempts to a Mirai-derived botnet variant named Potassium, which can download malware and launch DDoS attacks. Although attempts to exploit these vulnerabilities have increased since their disclosure and patch release, no confirmed successful breaches have been observed. An ASLR bypass exploit has been developed that works on production configurations with PHP error display disabled, but it requires a memory leak and specific conditions. Attacker tooling was found on a public server, but it targets uncommon configurations and has not yielded successful compromises. Patch adoption is ongoing but incomplete, with many PHP instances running unsupported versions unlikely to be patched.

Successful exploitation could allow unauthenticated remote code execution on vulnerable PHP servers, potentially enabling malware installation, including Mirai-derived botnets, and DDoS attacks. However, no confirmed successful compromises have been reported to date. The vulnerabilities pose a critical risk due to their high CVSS score and remote code execution capability, but exploitation is hindered by technical challenges such as ASLR and uncommon configuration requirements.

Official patches addressing CVE-2026-109618 and CVE-2026-109619 were released on October 21, 2026, in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations should apply these updates promptly. Systems running unsupported PHP versions are unlikely to receive patches and should be upgraded or isolated. Since exploitation attempts require specific server configurations, verifying and hardening PHP configurations (e.g., enabling error display off) can reduce risk. No confirmed successful exploits have been reported, indicating current mitigations and patching efforts are effective.