Security researchers have observed a surge of exploitation attempts against two newly disclosed PHP2Shell vulnerabilities, with attackers attempting to leverage the flaws to deploy a Mirai botnet variant known as Potassium. Despite the scale of the attacks, reaching into the millions of attempts, early analysis suggests that successfully weaponizing the vulnerabilities may be more difficult than initially assessed.

Vulnerability Details

The attacks target CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS score of 9.2. The flaws can lead to unauthenticated remote code execution, making them an attractive target for botnet operators looking to rapidly expand their infrastructure.

Attack Activity

Threat actors have been scanning for and attempting to exploit vulnerable systems at scale in an effort to enlist them into the Potassium botnet, a known variant of the Mirai malware family. Mirai-based botnets have historically been used to conduct large-scale distributed denial-of-service (DDoS) attacks by compromising internet-connected devices and servers.

Despite the volume of attempts, reports indicate that many of these exploitation efforts have been unsuccessful, suggesting that practical exploitation of CVE-2026-109618 and CVE-2026-109619 involves complexities beyond what the critical severity ratings might imply.

Recommendations

Given the critical severity of both vulnerabilities and the active, high-volume exploitation attempts, organizations running affected PHP2Shell deployments should prioritize patching immediately. Security teams should also:

  • Monitor for indicators of compromise associated with Potassium botnet activity
  • Review logs for unusual or repeated exploitation attempts against internet-facing systems
  • Apply vendor patches or mitigations as soon as they become available
  • Restrict unauthenticated access to vulnerable services where possible

Given the scale of scanning activity already observed, unpatched systems remain at elevated risk even though successful exploitation has reportedly proven difficult so far.