Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
Two days after PHP rolled out emergency fixes for thePHP2Shellvulnerabilities, threat actors have tried to use the flaws to spread a Mirai botnet. A security firm has also built an exploit that gets past a key memory protection, and an exposed attacker server has revealed custom tooling.
Even so, no successful in-the-wild compromise has been confirmed so far.
The threat has prompted many organizations to take systems offline as a precaution. Several government, school and hospital websites in Europe went dark on October 21, and the UK government said 32 of its services were unavailable and four partly unavailable, mostly due to precautionary measures taken while patches were applied.
PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical bugs in the PHP engine that can be exploited for unauthenticated remote code execution. Each has a CVSS v4.0 score of 9.2.
Wiz, OpenAI and Calif found the...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
