PHP2Shell attacks surge as Potassium botnet targets vulnerable servers

Attackers are trying to turn vulnerable PHP servers into bots for Potassium, a Mirai-derived distributed-denial-of-service (DDoS) network, but no server compromises had been confirmed as of October 23. The main targets were PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 for severity; patches appeared on October 21 after attacks had begun. Imperva logged 482,342 request attempts in 122,311 sessions against 21,998 sites in 103 countries within 24 hours, and Censys found more than 41 million internet-facing PHP services running affected versions by October 22, with about 1 million patched. On October 23, PHP disclosed CVE-2026-115560 and advised disabling session.uploadprogress.enabled pending a fix.