PHP2Shell exploited 5.5 hours before patch via Mirai-style loaders

The PHP2Shell flaw (CVE-2026-109618/109619) in PHP's core allowed arbitrary code execution through memory corruption. An exploit appeared 5.5 hours before the official patch, and Mirai-style loaders spread malware, turning servers into botnet nodes.

• Exploit landed 5.5 hours before the official patch
• Mirai-style loaders scan networks and install backdoors on vulnerable PHP
• Attack leads to web server takeover and self-propagates
• Flaws tracked as CVE-2026-109618 and CVE-2026-109619