Mirai botnet joins PHP2Shell attacks as ASLR bypass exploit emerges

Two days after PHP's emergency fixes, attackers are trying to exploit the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) to spread a Mirai-derived botnet called Potassium. VulnCheck built an exploit that bypasses ASLR on production setups, but no successful in-the-wild compromise has been confirmed.

• PHP2Shell covers two critical PHP RCE bugs rated CVSS 9.2, patched on October 21
• Sophos linked exploitation attempts to the Mirai-based Potassium botnet
• VulnCheck's exploit achieves RCE on x86-64 with ASLR enabled
• About 71% of 110 million PHP instances run end-of-life versions 5.4–8.1