Reports of attempted exploits targeting two recent PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), have surged, with several large companies observing scanning and probe activities linked to botnets like Potassium and Mirai. However, cybersecurity experts emphasize that no successful widespread exploitation has been confirmed, noting that proof-of-concept exploits mostly function only under ideal lab conditions and are impeded by protections such as address space layout randomization (ASLR). Despite the current challenges for attackers, experts warn that evolving exploit techniques could overcome these barriers soon, urging organizations to promptly patch vulnerable PHP systems.
https://therecord.media/php-php2shell-exploitation-attempts-pocs