CERT24Mirai botnet operators join PHP2Shell attacks as ASLR-bypass exploits emergeLoading data…
CERT24Threat Observatory
Period

Mirai botnet operators join PHP2Shell attacks as ASLR-bypass exploits emerge

Two days after PHP released fixes for the PHP2Shell vulnerabilities, threat actors attempted to use the flaws to spread a Mirai botnet. No successful compromise in the wild has been confirmed so far. PHP2Shell refers to two critical PHP engine vulnerabilities—CVE-2026-109618 and CVE-2026-109619—that allow unauthenticated remote code execution; each has a CVSS v4.0 score of 9.2.

← Back to intelligence

Mirai botnet operators join PHP2Shell attacks as ASLR-bypass exploits emerge

Two days after PHP released fixes for the PHP2Shell vulnerabilities, threat actors attempted to use the flaws to spread a Mirai botnet. No successful compromise in the wild has been confirmed so far. PHP2Shell refers to two critical PHP engine vulnerabilities—CVE-2026-109618 and CVE-2026-109619—that allow unauthenticated remote code execution; each has a CVSS v4.0 score of 9.2.