Botnets join PHP2Shell attacks, but no successful break-in confirmed as most PHP stays unpatched

Two days after PHP patched the PHP2Shell flaws, Sophos said attackers had tried to install "Potassium", which it believes is a variant of the Mirai botnet malware, through the bugs; the attempt was stopped, and Sophos corrected an earlier report of a successful exploit. Hunt.io linked the traffic to a Mirai-style botnet and found that, in 10 attack rounds against 123 servers, none was exploited.Sources:1SecurityWeek: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge, SecurityWeek, 23 October 2026 (source, opens in a new tab)

No successful in-the-wild compromise had been confirmed as of 23 October, SecurityWeek reported, and Wordfence said attacks continued without known compromises. Sansec said attackers need detailed knowledge of a server and that public exploits fail on default PHP setups. Earlier, Germany's BSI said it had seen attacks but no successful exploitation, calling the flaws "a little bit more complicated than expected to exploit".Sources:1SecurityWeek: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge, SecurityWeek, 23 October 2026 (source, opens in a new tab)2The Next Web: Millions of PHP2Shell attempts so far, but officials see no break-in, The Next Web, 22 October 2026 (source, opens in a new tab)

The risk has not gone away. VulnCheck said it built an exploit that defeats a key memory protection (ASLR) on some systems, available only to its paying customers, and SOCRadar found ready-made PHP2Shell tooling on an exposed attacker server. Qualys data from about 12,000 customers showed only 199,000 PHP instances patched in the first 12 hours, while about 110 million instances, or 71%, run end-of-life PHP versions.Sources:1SecurityWeek: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge, SecurityWeek, 23 October 2026 (source, opens in a new tab)

Disruption from precautionary shutdowns continued. The UK government said 32 of its services were unavailable and four partly unavailable, mostly as a precaution during patching, and CISA had not added either flaw to its catalogue of known exploited vulnerabilities as of the morning of 23 October.Sources:1SecurityWeek: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge, SecurityWeek, 23 October 2026 (source, opens in a new tab)