Security researchers warn that millions of websites remain at risk as exploitation attempts against two critical flaws in PHP have surged. 

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can enable an attacker to achieve remote-code execution. Each has a severity score of 9.2 out of 10. 

Exploitation attempts have surged since the vulnerabilities were first disclosed, and researchers have uncovered threat activity from Potassium, a Mirai-derived botnet originally discovered in March. 

Arctic Wolf said it observed an exploitation attempt that combined a “command-execution validation with a second-stage payload delivery.” 

Two malicious binaries were identified within the payload hosting infrastructure, but Arctic Wolf said it did not find enough evidence to show successful downloading or execution. 

Researchers from Sophos also observed threat activity linked to Potassium, but they were able to block an attack. An examination of the sample showed an updated and ‘significantly expanded’ version of the botnet variant, Sophos said. 

The PHP vulnerabilities have roiled the information security community since their formal disclosure on Wednesday. The scripting language powers roughly 70% of the websites across the globe. 

Researchers at Wiz said the vulnerabilities are among the most severe ever discovered in PHP. They compared the impact of successful exploitation to 2014’s Heartbleed vulnerability. 

Further analysis, however, shows the impact has fallen short of what was originally feared. 

“PHP2Shell generated immediate concern because of its severity, broad exposure implication, and AI-assisted discovery,” Justin Moore, director of adversary operations at Arctic Wolf, told Cybersecurity Dive. “So far, though, the reality has been less dramatic than the headlines.”

Flawed PoCs

Researchers from VulnCheck noted that most of the publicly released exploits don’t complete the chain necessary to trigger successful compromises, because they target a setting in PHP, called “display errors,” that is not commonly used in the real world.

“We’ve looked at PHP2shell exploit attempts, and the ‘best’ ones thus far have been ported from the public PoCs, while others are garbage or nonfunctional,” Spencer McIntyre, director of exploit development at VulnCheck told Cybersecurity Dive.

VulnCheck researchers said most of the publicly released proofs of concept target a setting in PHP called “display_errors,” which is not commonly used in the real world.

Charles Carmakal, CTO and board advisor at Mandiant, said there is no current evidence of successful widescale exploitation, in a post on LinkedIn. He said many of the current PoCs in circulation appear to have been vibe coded and cannot achieve RCE.

Google/Mandiant researchers have validated some PoCs that are “capable of RCE against default deployments of mod_php, but not PHP-FPM.”

“Nonetheless, exploitation may have already begun in a limited fashion, and the threat is viable and very serious,” Carmakal said.

He recommended security teams upgrade to PHP versions 8.5.12, 8.4.27, 8.3.36 or 8.2. 35 and restart web services.

Defenders should also rotate keys and passwords on internet-facing systems that were exposed prior to patching and then monitor for abnormal traffic.

Shadowserver Foundation on Monday declined to provide information on exposed and potentially vulnerable instances, citing a large volume of nonworking PoCs and failed exploitation attempts targeting its sensors. 

Shadowserver is reporting end-of-life instances that are no longer receiving support. There are nearly 282,000 listed in the U.S. 

Late exploitation

The Cybersecurity and Infrastructure Security Agency on Monday added the PHP flaws to its Known Exploited Vulnerabilities catalog.

The agency urged users to immediately patch their systems and updated an advisory on PHP mitigation, which was originally released on Friday.  CISA issued a Sigma detection rule to help identify suspicious activity. 

CISA set a deadline of Thursday for Federal Civilian Executive Branch agencies to mitigate their systems.

Editor’s note: Updates with comment from CISA, Shadowserver Foundation, Mandiant and additional information from VulnCheck.