[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZhUIxi0UREDzLZjaOesXu68QHtR9MjK7KM--Am21cqY":3},{"article":4,"iocs":43,"watch_terms":83,"solutions":84,"lesson":178},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"932e9244-b4e1-4900-b816-c38d536b4b56","PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware","php2shell-exploit-attempts-hit-millions-as-attackers-try-to-deploy-mirai-malware-9d0cfa","Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote","Threat actors are attempting to exploit newly disclosed PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) to deploy a Mirai botnet variant called Potassium. While exploit attempts have been observed, successful infections appear limited, suggesting weaponization may be challenging. The botnet aims to launch DDoS attacks and has been linked to specific IP addresses and C2 infrastructure.","Attackers attempt to deploy Potassium Mirai botnet variant using PHP2Shell vulnerabilities.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fphp2shell-exploit-attempts-hit-millions.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh3SkRCDhjMsUS2FZ9ES40x39o7u2jdwMQDcq4NC75CsC2Xjji94ZZt_0Jgzdxmbf92n3razC07QvKJ-VT65axzIbXWoYrHytaQhNRBdYEMgmb1Fki-gR2NKY1TXuhpb9lcCemaPSqu8E0Q6KVczRNa97_7tj5Vyt0wngICj6GnWEHphW8fpaSybzKAa-pV\u002Fs1600\u002Fphpshell.jpg","2026-10-23T07:40:45+00:00","2026-10-23T08:00:10.476772+00:00",8,[17],{"name":18,"type":19},"PHP2Shell","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":22,"name":23,"slug":24},null,"Malware","malware",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,48,50,54,57,59,61,64,66,68,71,75,78,80],{"type":45,"value":46,"context":47},"cve","CVE-2026-109618","PHP2Shell vulnerability exploited by attackers.",{"type":45,"value":49,"context":47},"CVE-2026-109619",{"type":51,"value":52,"context":53},"ip","134.199.154.64","Command-and-control (C2) address for Potassium botnet.",{"type":51,"value":55,"context":56},"8.8.8.8","Public DNS server used for fallback resolution by the malware.",{"type":51,"value":58,"context":56},"1.1.1.1",{"type":51,"value":60,"context":56},"1.0.0.1",{"type":51,"value":62,"context":63},"85.11.167.243","IP address originating attack attempts.",{"type":51,"value":65,"context":63},"217.60.242.76",{"type":51,"value":67,"context":63},"45.198.224.169",{"type":51,"value":69,"context":70},"92.118.112.100","IP address contacted to retrieve a loader for the botnet.",{"type":72,"value":73,"context":74},"domain","thunder.godofthunder.st","Domain queried by the botnet to resolve C2 infrastructure.",{"type":51,"value":76,"context":77},"45.88.138.0","Target host within a Ukrainian network for DDoS attacks.",{"type":51,"value":79,"context":77},"45.88.138.44",{"type":51,"value":81,"context":82},"206.188.197.105","Attacker-controlled server hosting PHP2Shell exploit tooling.",[],{"controls":85,"vendors":171},[86,114,143],{"slug":87,"name":88,"problem":89,"products":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",[91,99,106],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":87,"product_name":103,"url":104,"description":105},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":115,"name":116,"problem":117,"products":118},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":42,"name":144,"problem":145,"products":146},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[147,155,163],{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":156,"vendor_name":157,"vendor_logo":158,"product_slug":159,"product_name":160,"url":161,"description":162},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":164,"vendor_name":165,"vendor_logo":166,"product_slug":167,"product_name":168,"url":169,"description":170},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[172],{"slug":173,"name":174,"logo_path":175,"roles":176},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png",[177],"reported_by",{"slug":179,"title":180,"body":181,"framework_refs":182,"framework_notes":190},"php2shell-exploits-drive-mirai-botnet-campaign-against-millions-of-targets","PHP2Shell Exploits Drive Mirai Botnet Campaign Against Millions of Targets","Attackers are actively attempting to exploit newly disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to deploy a Mirai-based botnet variant called Potassium, targeting internet-facing systems at massive scale. The campaign illustrates how quickly threat actors weaponize newly published CVEs, turning disclosed vulnerabilities into live attack infrastructure within a short window. While successful infections appear limited — suggesting the exploit is not trivially easy to weaponize — the sheer volume of attempts underscores the risk to unpatched systems. Organizations that delay applying patches to internet-exposed services give attackers exactly the opportunity they need to compromise assets and conscript them into DDoS botnets.",[183,184,185,186,187,188,189],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":191,"NIST SP 800-53 SI-2: Flaw Remediation":192,"CIS Control 17: Incident Response Management":193,"OWASP A06:2021 Vulnerable and Outdated Components":194,"CIS Control 7: Continuous Vulnerability Management":195,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":196,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":197},"NIS2 mandates that essential and important entities implement policies on vulnerability handling and incident management, which would require expedited patching processes for critical flaws like those exploited in this campaign.","SI-2 requires organizations to identify, report, and correct information system flaws promptly; adhering to this control would mandate rapid patching of the PHP2Shell vulnerabilities before active exploitation reached scale.","Having a mature incident response capability with pre-defined playbooks for botnet exploitation attempts would allow organizations to contain infections faster and reduce the window of exposure once exploitation is detected.","PHP2Shell instances running unpatched versions represent exactly the vulnerable and outdated component risk OWASP A06 warns against, highlighting the need to track and update third-party software continuously.","Regular vulnerability scanning and time-bound remediation of newly disclosed CVEs like CVE-2026-109618 and CVE-2026-109619 would have ensured patches were applied before attackers could mount millions of exploit attempts.","This control requires timely identification and remediation of technical vulnerabilities in information systems, directly addressing the failure to patch PHP2Shell before widespread exploit attempts began.","Restricting which systems and users can reach internet-facing PHP2Shell endpoints through strong access controls limits the attack surface available to exploit attempts targeting these vulnerabilities."]