Attackers are reportedly attempting to exploit newly disclosed PHP2Shell vulnerabilities in large numbers, with the apparent goal of compromising exposed systems and enrolling them into a Mirai-based botnet variant. While early reporting indicates that successful exploitation may be harder than first assumed, the volume of observed activity still matters for businesses running internet-facing PHP environments.

What happened

According to reporting cited in the source, threat actors have been observed trying to exploit two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, both described as severe issues with CVSS scores of 9.2. The attacks were reportedly linked to attempts to deploy a Mirai malware variant referred to as Potassium.

The source says the exploitation attempts have so far been unsuccessful in many cases and that turning the flaws into a reliable attack path may be more difficult than initially expected. Even so, widespread scanning and exploit attempts are common after public disclosure of high-severity vulnerabilities, especially when they affect technologies used in web infrastructure.

Why it matters for European businesses

For European companies, the immediate concern is not only whether these specific attacks are succeeding at scale, but that attackers are actively testing exposed systems soon after disclosure. That shortens the window between vulnerability publication and real-world attack activity.

Businesses that rely on PHP-based applications, hosting stacks, custom websites, e-commerce platforms or legacy web services may face elevated risk if vulnerable components are internet-accessible. Even unsuccessful exploit waves can create operational pressure for IT teams through increased scanning, suspicious traffic and incident response workload.

If exploitation becomes more reliable, affected systems could potentially be used for malware deployment, botnet activity or further compromise. In practical terms, that can mean service disruption, reputational risk, abuse of hosting resources and possible downstream security incidents affecting customer-facing services.

The story is also relevant because Mirai-style botnets typically focus on scale. Attackers do not need every target to be exploitable; they only need enough exposed systems to build useful attack infrastructure.

Who may be affected

• SMEs running PHP-based websites or applications, especially where patching is delayed or asset inventories are incomplete.
• E-commerce businesses that depend on internet-facing web servers and plugins, where availability and trust are business-critical.
• Managed hosting providers, agencies and IT teams maintaining multiple customer websites or legacy PHP environments.
• Companies with older custom web applications that may not have modern update processes, monitoring or segmentation in place.
• Businesses with exposed development or staging systems that can be overlooked in normal patch management.

What companies should consider

• Verify exposure by identifying where affected PHP components or configurations are present across production, staging and development systems.
• Apply vendor guidance and security updates as soon as validated patches or mitigation steps are available. If the environment is managed by a hosting provider or agency, confirm their remediation status.
• Review internet-facing attack surface, including forgotten subdomains, admin panels and older applications that may still be reachable.
• Increase monitoring for unusual requests, exploit attempts, unexpected process execution and outbound traffic patterns that could indicate malware deployment or botnet activity.
• Strengthen containment by limiting unnecessary public exposure, segmenting workloads and restricting privileges on web servers where possible.
• Prepare incident response steps for web server compromise, including log preservation, credential rotation and restoration from known-good backups.

At this stage, businesses should distinguish between confirmed exploit attempts and any assumption of widespread successful compromise. However, the combination of severe disclosed flaws and immediate attacker interest is enough to justify prompt review of PHP-based infrastructure.