Security researchers warn that millions of websites remain at risk as exploitation attempts against two critical flaws in PHP have surged.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can enable an attacker to achieve remote-code execution. Each has a severity score of 9.2 out of 10.
Exploitation attempts have surged since the vulnerabilities were first disclosed, and researchers have uncovered threat activity from Potassium, a Mirai-derived botnet originally discovered in March.
Arctic Wolf said it observed an exploitation attempt that combined a “command-execution validation with a second-stage payload delivery.”
Two malicious binaries were identified within the payload hosting infrastructure, but Arctic Wolf said it did not find enough evidence to show successful downloading or execution.
Researchers from Sophos also observed threat activity linked to Potassium, but they were able to block an attack. An examination of the sample showed an updated and ‘significantly expanded’ version of the botnet variant, Sophos said.
The PHP vulnerabilities have roiled the information security community since their formal disclosure on Wednesday. The scripting language powers roughly 70% of the websites across the globe.
Researchers at Wiz said the vulnerabilities are among the most severe ever discovered in PHP. They compared the impact of successful exploitation to 2014’s Heartbleed vulnerability.
Further analysis, however, shows the impact has fallen short of what was originally feared.
“PHP2Shell generated immediate concern because of its severity, broad exposure implication, and AI-assisted discovery,” Justin Moore, director of adversary operations at Arctic Wolf, told Cybersecurity Dive. “So far, though, the reality has been less dramatic than the headlines.”
Researchers from VulnCheck noted that most of the publicly released exploits don’t complete the chain necessary to trigger successful compromises, because they target a setting in PHP, called “display errors,” that is not commonly used in the real world.
“We’ve looked at PHP2shell exploit attempts, and the ‘best’ ones thus far have been ported from the public PoCs, while others are garbage or nonfunctional,” Spencer McIntyre, director of exploit development at VulnCheck told Cybersecurity Dive.
VulnCheck researchers said most of the publicly released proofs of concept target a setting in PHP called “display_errors,” which is not commonly used in the real world.
Charles Carmakal, CTO and board advisor at Mandiant, said there is no current evidence of successful widescale exploitation, in a post on LinkedIn. He said many of the current PoCs in circulation appear to have been vibe coded and cannot achieve RCE.
Google/Mandiant researchers have validated some PoCs that are “capable of RCE against default deployments of mod_php, but not PHP-FPM.”
“Nonetheless, exploitation may have already begun in a limited fashion, and the threat is viable and very serious,” Carmakal said.
He recommended security teams upgrade to PHP versions 8.5.12, 8.4.27, 8.3.36 or 8.2. 35 and restart web services.
Defenders should also rotate keys and passwords on internet-facing systems that were exposed prior to patching and then monitor for abnormal traffic.
