Threat actors have attempted to use PHP2Shell vulnerabilities to spread a Mirai botnet, but no successful compromise has been confirmed yet.
The vulnerability or weakness
The PHP2Shell flaws, identified as CVE-2026-109618 and CVE-2026-109619, have a CVSS v4.0 score of 9.2 and can be exploited for unauthenticated remote code execution. These vulnerabilities prompted emergency patches from PHP.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-109618 | 9.2 | CRITICAL | No | - |
| CVE-2026-109619 | 9.2 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations, especially government and educational institutions, have taken precautionary measures, leading to some services being taken offline. This could result in operational disruptions and potential legal and reputational risks.
Industries affected
Government, education, and healthcare sectors are primarily affected due to the nature of the targeted services.
Users affected
End-users and customers of affected organizations may experience temporary service outages and increased cybersecurity awareness, leading to potential inconvenience and data security concerns.
