Security · Updated 23 Oct, 01:10 pm IST
Attackers tried PHP2Shell flaws to deploy Mirai-derived Potassium botnet
Why it matters for readers: This shows how attackers chain a web bug to install a botnet and why researchers trace C2 and payload behaviour.
- Attack attempts targeted two PHP2Shell RCE vulnerabilities with CVSS 9.2, tracked as CVE-2026-109618 and CVE-2026-109619.1
- The PHP vulnerabilities have been patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.1
- Sophos analysts found the payload is an expanded Mirai-derived variant named Potassium that includes downloader and network disruption (DDoS) functionality.1
- The sample resolves a hard-coded encrypted C2, connects to 134.199.154[.]64, checks for HTTP 200, and expects a Linux ELF binary as a follow-on payload.1
- The malware’s resolver supports IPv4 and hostnames and falls back to public DNS servers such as 8.8.8.8, 1.1.1.1, and 1.0.0.1.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started