PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

Live updates

1. 59m ago

   PHP2Shell Exploit Attempts Target Millions Over Malware

   Automated exploitation attempts targeting critical PHP2Shell vulnerabilities have surged into the millions, with malicious actors actively trying to deploy Mirai malware across vulnerable servers. Honeypot monitoring indicates that initial scanning probes have successfully transitioned into working remote code execution shells. The surge follows the public disclosure of a pair of high-impact memory safety flaws in core PHP versions spanning 5.4 through 8.5. Emergency security updates have been issued for versions 8.2 through 8.5, prompting organizations worldwide to temporarily take government and business websites offline to apply urgent patches.

   Why it matters

   Discovered with the aid of artificial intelligence in August 2026 and publicly announced on October 20, the vulnerabilities bypass authentication to grant potential remote control of web hosts. The emergency response has intensified scrutiny on the under-funded state of core internet infrastructure maintenance. Meanwhile, maintainers have warned of additional unpatched remote code execution issues arriving just days after the initial emergency patches.

   What is confirmed

   • PHP2Shell consists of high-impact memory safety flaws tracked as CVE-2026-109618 and CVE-2026-109619 affecting PHP versions 5.4 through 8.5.
   • Emergency patches were released for PHP versions 8.2, 8.3, 8.4, and 8.5 following public disclosure on October 20, 2026.
   • Honeypot data and threat intelligence show exploit attempts have reached millions as attackers attempt to deploy Mirai malware and execute working shell commands.
   • PHP warned of another unpatched remote code execution vulnerability just two days after the emergency PHP2Shell patches.

   Still unconfirmed

   • Hackers appear to be struggling to exploit PHP flaws after the global cybersecurity crisis.

   What to watch next

   • Deployment rates of Mirai malware across newly scanned PHP servers
   • Adoption and patch application rates tracked globally by network intelligence services
   • Official security disclosures regarding subsequent unpatched remote code execution flaws warned by PHP maintainers
   Sources used for this update (28)

   1. wiz.io — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
   2. Amazon Web Services — Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
   3. The New York Times — What Is PHP? Why Are Government and Business Websites Going Offline?
   4. NBC News — Hackers appear to be struggling to exploit PHP flaws after global cybersecurity crisis
   5. NPR — Hacking attempts rise after flaws found in program affecting 70 percent of websites
   6. CNN — The biggest-ever internet security threat has been known for 22 years. AI made it a crisis in 2 days
   7. The Hacker News — PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
   8. The Hacker News — PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
   9. Los Angeles Times — How AI helped expose critical flaws in the code powering most websites
   10. Reuters — AI-discovered bugs may soon trigger fresh disruptions, cyber experts say
   11. CNBC — AI's 'Black October': Critical PHP flaws set off global security scramble
   12. The Atlantic — The Safe Internet Is Shrinking
   confidence 100%