Attackers have launched millions of attempts to exploit the recently disclosed PHP2Shell vulnerabilities, aiming to deploy a Mirai botnet variant called Potassium, according to reports summarised by cybersecurity trackers. Despite the scale of scanning, no successful remote code execution or payload deployment has been confirmed, suggesting attackers are struggling to weaponise the flaws reliably.

What PHP2Shell is

The flaws, CVE-2026-109618 and CVE-2026-109619, are critical remote code execution vulnerabilities in PHP versions 8.2 to 8.5, each scored 9.2, disclosed on 21 October with emergency patches. PHP is the language behind a large share of the world’s websites, including WordPress, Drupal and Joomla, so a flaw in PHP itself puts many different sites at risk at once. A separate, rarer PHP issue disclosed days later, CVE-2026-115560, is considered unlikely to be exploited and will be fixed in a routine release.

The scale of the probing

Cloudflare observed exploit attempts rising from thousands to millions per hour after disclosure, and more than 34 million PHP services were described as remaining vulnerable, with precautionary website shutdowns reported globally. The Philippines’ national computer emergency response team, CERT-PH, has told government agencies, critical infrastructure operators and hosting providers to patch immediately, while noting it had not established any confirmed PHP2Shell compromise of a Philippine organisation.

What this means for site owners

The honest picture is two-sided: the flaws are genuinely critical and the probing is real, but the absence of confirmed takeovers suggests patching still wins this race. The priority remains identifying affected PHP versions, installing the correct fixes, and checking exposed services — not assuming that a site is safe because attackers have not yet succeeded.