PHP2Shell Vulnerabilities Actively Exploited in Failed Mirai Botnet Campaigns

Cyber threat actors are actively attempting to exploit two critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. These flaws, collectively known as PHP2Shell, enable unauthenticated remote code execution and are being leveraged in campaigns to compromise servers for a Mirai botnet variant named Potassium. Despite widespread scanning and exploitation attempts, reports suggest attackers are facing challenges in successfully weaponizing these vulnerabilities.

Security advisories confirm that both bugs pose significant risk, with CVSS scores of 9.2. The first vulnerability relates to improper handling of memory during request processing, while the second involves incorrect management of internal request states across reused workers. Successful exploitation could allow full system takeover by remote attackers without authentication.

Vulnerability Details

• CVE-2026-109618 affects PHP's memory management when processing requests, potentially leading to arbitrary code execution.
• CVE-2026-109619 impacts how PHP handles internal request states across worker processes, creating a similar avenue for remote exploitation.
• Both issues require no authentication and affect all major PHP deployments unless patched.
• They carry a combined CVSS severity rating of 9.2, indicating critical risk.

Patch Availability

• Ubuntu has issued updates through USN-8948-2 covering releases from Ubuntu 14.04 LTS up to 26.10.
• Previous patch USN-8948-1 addressed the issue for Ubuntu 22.04, 24.04, 26.04, and 26.10.
• Organizations using older Ubuntu LTS versions must update to mitigate exposure.
• System administrators managing PHP installations outside standard repositories should consult vendor advisories or upstream patches.

Sources

• PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
• USN-8948-2: PHP vulnerabilities