Security researchers flag botnet activity, but successful compromises have yet to break through.
Security researchers warn that millions of websites remain at risk as exploitation attempts against two critical flaws in PHP have surged.
The vulnerabilities, tracked asCVE-2026-109618andCVE-2026-109619, can enable an attacker to achieve remote-code execution. Each has a severity score of 9.2 out of 10.
Exploitation attempts have surged since the vulnerabilities were first disclosed, and researchers have uncovered threat activity from Potassium, a Mirai-derived botnet originally discovered in March.
Arctic Wolf said itobserved an exploitation attemptthat combined a “command-execution validation with a second-stage payload delivery.”
Two malicious binaries were identified within the payload hosting infrastructure, but Arctic Wolf said it did not find enough evidence to show successful downloading or execution.
Researchers from Sophosalso observed threat activitylinked to Potassium, but they were able to block an attack. An examination of the sample showed an updated and ‘significantly expanded’ version of the botnet variant, Sophos said.
The PHP vulnerabilities have roiled the information security community since their formal disclosure on Wednesday. The scripting language powers roughly 70% of the websites across the globe.
Researchers at Wiz said thevulnerabilities are among the most severeever discovered in PHP. They compared the impact of successful exploitation to 2014’s Heartbleed vulnerability.
Further analysis, however, shows the impact has fallen short of what was originally feared.
“PHP2Shell generated immediate concern because of its severity, broad exposure implication, and AI-assisted discovery,” Justin Moore, director of adversary operations at Arctic Wolf, told <a href="https://bitcomme.com/sailpoint-soars-11-palo-alto-up-6-crowdstrike-up-6-as-cybersecurity-stocks-rally/” title=”SailPoint Soars 11%, Palo Alto Up 6%, CrowdStrike Up 6% as Cybersecurity Stocks Rally”>Cybersecurity Dive. “So far, though, the reality has been less dramatic than the headlines.”
Researchers from VulnCheck noted that most of the publicly released exploits don’t complete the chain necessary to trigger successful compromises, because theytarget a setting in PHP, called “display errors,” that is not commonly used in the real world.
“We’ve looked at PHP2shell exploit attempts, and the ‘best’ ones thus far have been ported from the public PoCs, while others are garbage or nonfunctional,” Spencer McIntyre, director of exploit development at VulnCheck told Cybersecurity Dive.
