```
Millions of PHP2Shell Exploit Attempts Fail as Attackers Chase Mirai Botnet Slots
Attackers have thrown millions of attempts at a pair of newly disclosed high-severity PHP vulnerabilities, according to The Hacker News — but the campaign has so far been largely unsuccessful, suggesting that weaponising the flaws is harder than initially assumed.
The report describes sustained exploitation attempts against CVE-2026-109618 and CVE-2026-109619, which The Hacker News said carry CVSS scores of 9.2 and can lead to unauthenticated remote compromise. The activity is aimed at enrolling compromised hosts into a Mirai botnet variant that researchers have dubbed "Potassium" — a working label rather than the official name of the malware family.
The central tension in the story is the gap between attempt volume and success rate. Millions of probes represent a wide net, not millions of compromised systems. For operators running PHP workloads, that distinction matters in both directions: there is no evidence of mass-scale compromise from this campaign as described, but brute-force economics still favour the attacker over time.
Why a low success rate should not breed complacency
Mirai-style botnets have historically been built on volume. A scanner that fails against the overwhelming majority of targets can still populate a large botnet across a fleet of internet-exposed hosts, because the marginal cost of another attempt is close to zero. A flaw that defeats 99 per cent of attempts remains valuable to an operator trying to enlist thousands of machines.
The practical implication is straightforward: patch as though the CVSS 9.2 rating is real, and assume exploit tooling will improve. Attackers moved quickly once these flaws were public, and today's unsuccessful campaign may be tomorrow's reliable one.
What the report does and does not establish
The Hacker News attributes the attempt counts and the largely unsuccessful outcome to threat telemetry it describes; the underlying measurement window and the party that collected the data were not detailed in the material available to this writer. Readers should treat the "millions of attempts" figure as reported telemetry rather than independently verified fact.
Likewise, the CVE identifiers and their CVSS scores are cited as reported by The Hacker News. PHP operators should confirm the affected versions and available fixes against official PHP project advisories and their own package sources before deploying changes — a routine step that also serves as a check on any downstream reporting.
A practical checklist for PHP fleet operators
- Inventory exposure. Identify every internet-facing service running PHP, including legacy internal tools and third-party admin panels.
- Confirm your version. Check whether your installed PHP version falls within the affected ranges in official advisories, and prioritise patching accordingly.
- Patch or upgrade. Apply vendor-supported updates on a defined schedule; treat these CVEs as urgent given the reported active exploitation attempts.
- Reduce the attack surface. Restrict administrative endpoints behind network access controls, disable unnecessary remote features, and enforce strong, unique credentials on anything exposed — brute force remains a core Mirai recruitment tactic.
- Monitor and verify. Watch for outbound scanning traffic that would suggest successful botnet enrolment, and confirm after patching that systems no longer respond to known exploit patterns.
For Hong Kong IT teams and managed service providers running shared PHP hosting or bespoke web applications, the story is a timely reminder that exploit volume alone does not equal compromise — and that the correct response to an unsuccessful-but-persistent campaign is disciplined patching, not reassurance.
Source: The Hacker News.
```
數以百萬計 PHP2Shell 漏洞利用嘗試屢告失敗 攻擊者瘋搶 Mirai botnet 名額
據 The Hacker News 報道，攻擊者已對一對新披露的高嚴重性 PHP 漏洞發動數以百萬計的嘗試，惟行動迄今大體未能得手，顯示將這些漏洞武器化的難度遠超最初估計。
報告描述針對 CVE-2026-109618 及 CVE-2026-109619 的持續漏洞利用嘗試；The Hacker News 指兩者 CVSS 評分達 9.2，可導致未經身份驗證的遠端入侵。有關行動旨在將已受感染主機納入一個 Mirai botnet 變種，研究人員暫稱之為「Potassium」——此乃工作名稱，並非官方 malware family 的正式名稱。
事件的核心矛盾在於嘗試數量與成功率之間的落差。數百萬次探測代表撒下大網，而非數百萬部系統已受入侵。對運行 PHP 工作負載的營運商而言，這項區別在兩個方向同樣重要：就所述情況，並無證據顯示此次行動造成大規模入侵，但長遠而言，brute-force 的經濟模式仍對攻擊者有利。
為何低成功率不應令人掉以輕心
Mirai 式 botnet 歷來以數量取勝。即使 scanner 對絕大多數目標屢屢失手，仍可在大量互聯網暴露主機的 fleet 中填滿一個大型 botnet，因為再多一次嘗試的邊際成本趨近於零。一個能擊敗 99% 嘗試的漏洞，對正試圖招攬數千部機器的營運商而言依然有價值。
實際啟示十分直接：應按 CVSS 9.2 評分屬實來進行修補，並假設 exploit 工具會持續改進。這些漏洞一經公開，攻擊者便迅速行動，今日未能得手的行動，隨時可能成為明日穩定奏效的行動。
報告證實了甚麼、未證實甚麼
The Hacker News 將嘗試次數及大體失敗的結果歸因於其所述的 threat telemetry；在本作者可得的材料中，並未詳述背後的測量時段及數據收集方。讀者應將「數以百萬計嘗試」視為已報道的 telemetry，而非經獨立核實的事實。
同樣，相關 CVE 編號及其 CVSS 評分，均按 The Hacker News 的報道引用。PHP 營運商在部署變更前，應對照官方 PHP 專案 advisories 及自身 package 來源，核實受影響版本及可用修復方案——這既是慣常步驟，也可作為對任何下游報道的覆核。
PHP fleet 營運商實用檢查清單
- 盤點暴露範圍。 識別所有面向互聯網的 PHP 服務，包括遺留內部工具及第三方管理面板。
- 確認版本。 檢查已安裝的 PHP 版本是否落入官方 advisories 所列受影響範圍，並據此排定修補優先次序。
- 修補或升級。 按既定時間表套用供應商支援的更新；鑑於已有活躍漏洞利用嘗試的報道，應將這些 CVE 列為緊急處理。
- 縮減 attack surface。 將管理端點置於網絡存取控制之後，停用不必要的遠端功能，並對一切暴露項目強制使用強而獨特的憑證——brute force 仍是 Mirai 招募成員的核心手段。
- 監察及核實。 留意可能顯示 botnet 成功招募的出站掃描流量，並在修補後確認系統不再對已知 exploit pattern 作出回應。
對運行共享 PHP hosting 或訂製 web 應用的香港 IT 團隊及 managed service providers 而言，此事及時提醒：exploit 數量本身不等於入侵——面對雖未得手但持之以恆的行動，正確回應是有紀律的 patching，而非自我安慰。
Source: The Hacker News.