PHP2Shell exploitation attempts grow; new unpatched PHP flaw disclosed

· Cybersecurity

Attackers are probing the newly disclosed PHP2Shell vulnerabilities — CVE-2026-109618 and a companion flaw — at scale, with researchers tying attempts to the Mirai botnet's Potassium variant in an effort to enroll servers into the malware network, while Amazon Threat Intelligence says exploitation began four days before PHP released emergency fixes on Wednesday. No successful compromise of the core flaws has been confirmed, and analysts caution that weaponizing them may be harder than the headlines suggest. Separately, PHP warned of a new remote code execution issue, CVE-2026-115560, affecting only applications with unusual configurations, and published mitigation guidance rather than a patch. Experts say fixing the original flaws is not as simple as clicking update, and advise assessing exposure before making changes.

Why it matters：The scramble shows how fast a widely deployed scripting-language flaw becomes a botnet recruitment tool and pressures enterprises to patch web infrastructure under uncertainty.

Key points

  • Amazon says exploitation attempts predate the emergency patches by four days
  • Mirai operators are trying to deploy a variant called Potassium, with no confirmed success
  • PHP's new CVE-2026-115560 affects only non-default configurations

Sources (original reporting)

More stories from this day