# Botnets join PHP2Shell attacks, but no successful break-in confirmed as most PHP stays unpatched

Technology · 23 October 2026 · United Kingdom
URL: https://connectthedots.news/event/2026-10-23-botnets-join-php2shell-attacks-but-no-successful-break-in-confirmed

> Mirai-style botnets tried to exploit the PHP2Shell flaws, yet security firms found no confirmed compromise, while Qualys data showed most PHP installations still exposed.

Two days after PHP patched the PHP2Shell flaws, Sophos said attackers had tried to install "Potassium", which it believes is a variant of the Mirai botnet malware, through the bugs; the attempt was stopped, and Sophos corrected an earlier report of a successful exploit. Hunt.io linked the traffic to a Mirai-style botnet and found that, in 10 attack rounds against 123 servers, none was exploited. [1]

No successful in-the-wild compromise had been confirmed as of 23 October, SecurityWeek reported, and Wordfence said attacks continued without known compromises. Sansec said attackers need detailed knowledge of a server and that public exploits fail on default PHP setups. Earlier, Germany's BSI said it had seen attacks but no successful exploitation, calling the flaws "a little bit more complicated than expected to exploit". [1][2]

The risk has not gone away. VulnCheck said it built an exploit that defeats a key memory protection (ASLR) on some systems, available only to its paying customers, and SOCRadar found ready-made PHP2Shell tooling on an exposed attacker server. Qualys data from about 12,000 customers showed only 199,000 PHP instances patched in the first 12 hours, while about 110 million instances, or 71%, run end-of-life PHP versions. [1]

Disruption from precautionary shutdowns continued. The UK government said 32 of its services were unavailable and four partly unavailable, mostly as a precaution during patching, and CISA had not added either flaw to its catalogue of known exploited vulnerabilities as of the morning of 23 October. [1]

## Who was involved

- [PHP Foundation](https://connectthedots.news/org/php-foundation): Released the 21 October patches that defenders are racing to apply [1][2]
- [Sophos](https://connectthedots.news/org/sophos): Stopped a Mirai-variant install attempt; corrected a report of a successful exploit [1]
- [Qualys](https://connectthedots.news/org/qualys): Found 71% of PHP installations it tracks run end-of-life versions [1]
- [VulnCheck](https://connectthedots.news/org/vulncheck): Built a working exploit that bypasses ASLR on some systems [1]
- [Federal Office for Information Security](https://connectthedots.news/org/federal-office-for-information-security): Saw attacks but no successful exploitation [2]

## Linked stories

- Follow-up of: [AI-found PHP2Shell flaws push governments and companies to take websites offline](https://connectthedots.news/event/2026-10-22-ai-found-php2shell-flaws-push-governments-and-companies-to-take) (22 October 2026)

## Sources

1. SecurityWeek, "Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge", 23 October 2026: https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge/
2. The Next Web, "Millions of PHP2Shell attempts so far, but officials see no break-in", 22 October 2026: https://thenextweb.com/news/php2shell-millions-exploit-attempts-no-confirmed-breaches