PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Summary: Attackers have been attempting, so far unsuccessfully, to exploit the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2, unauthenticated RCE via crafted HTTP requests) to deploy a Mirai variant called Potassium, with Cloudflare observing tens of thousands of exploit attempts 45 minutes after public disclosure, hundreds of thousands within 2 hours, and millions by early October 22, 2026. The flaws are patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and Censys assessed more than 34.4 million PHP services still vulnerable as of October 23, 2026.
Why it matters: Censys counts over 4.18 million hosts and 67.5 million web properties running PHP, and the bugs sit in the PHP engine itself, so a WordPress, Drupal, or Joomla site with clean application code is still exposed - with no fixes available for older branches, the tail is expected to run Log4Shell-length.