Attackers Target New PHP Flaws to Build a Mirai Botnet, but Struggle to Make Exploits Work

Threat actors have been seen trying to exploit two newly disclosed PHP vulnerabilities, known as PHP2Shell, to pull infected systems into a Mirai botnet variant called Potassium. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, both carry a severity score of 9.2. They can allow unauthenticated remote code execution through specially crafted web requests. Patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Sophos found that the attempts have not succeeded in the wild, which suggests attackers are struggling to build reliable exploits. The malware sample itself is more concerning. Sophos describes it as an updated and significantly expanded version of a Mirai-derived botnet first identified in early 2026. It contains downloader and network disruption features, contacts a hard-coded, encrypted command-and-control address, and expects to receive a Linux executable as a follow-on payload. It can also carry out DDoS attacks, as Mirai malware has historically done.

The attacks came from three IP addresses, which contacted a separate server to retrieve a loader that deploys the botnet. In a contained sandbox, the botnet connected to its control server and was aimed at sustained flood attacks against two adjacent hosts in a single Ukrainian network. The source describes weaponising the flaws as harder than first thought, but that is no reason to delay patching.