PHP exploitation moves at slower-than-expected pace, but millions remain at risk
This audio is auto-generated. Please let us know if you have feedback.
Security researchers warn that millions of websites remain at risk as exploitation attempts against two critical flaws in PHP have surged.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can enable an attacker to achieve remote-code execution. Each has a severity score of 9.2 out of 10.
Exploitation attempts have surged since the vulnerabilities were first disclosed, and researchers have uncovered threat activity from Potassium, a Mirai-derived botnet originally discovered in March.
Arctic Wolf said it observed an exploitation attempt that combined a “command-execution validation with a second-stage payload delivery.”
Two malicious binaries were identified within the payload hosting infrastructure, but Arctic Wolf said it did not find enough evidence to show successful downloading or execution.
Researchers from Sophos also observed threat activitylinked to Potassium, but they were able to block an attack. An examination of...
Copyright of this story solely belongs to www.ciodive.com. To see the full text click HERE
