Attackers are attempting to conscript vulnerable PHP servers into "Potassium," a Mirai-derived botnet built for distributed denial-of-service (DDoS) attacks — but so far the campaign has struggled to land. Mirai's source code went public in 2016, and botnets descended from the strain have driven some of the largest DDoS campaigns on record. The Hacker News reported on October 23 that no server compromises had been confirmed, even as exploit attempts reached into the hundreds of thousands.

The targeted flaws

The campaign centers on two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both of which received severity scores of 9.2 out of 10 — a level that lands squarely in the critical range of the CVSS scale — and both of which permit unauthenticated remote code execution, meaning an attacker needs no credentials to run commands on a vulnerable server. PHP released patches on October 21, but by that time hackers had already begun launching attacks against the flaws.

Millions of probes, zero confirmed break-ins

The figures do indicate how extensively attackers are probing. Imperva recorded 482,342 request attempts in 122,311 sessions aimed at 21,998 sites in 103 countries within a 24-hour period. Meanwhile, Censys reported detecting more than 41 million internet-facing PHP services running affected versions, with only about 1 million instances running patched versions of the software by October 22 — leaving the overwhelming majority of exposed servers without a fix a full day after patches shipped. Counts of scanning activity or exposure are not sufficient to prove an actual compromise occurred.

What Sophos saw, then walked back

Arctic Wolf reports that attempted command execution and malware downloads have been attributed to Potassium. A separate sandbox assessment revealed a different sample that reached out to thunder.godofthunder[.]st through IP 134.199.154[.]64 at TCP port 50792 and attacked two Ukrainian hosts. That demonstrated the malware's potential, but not that attackers have breached production servers. On October 22, Sophos retracted a prior success announcement, telling The Record that it had only observed unsuccessful attack attempts.

24 flood commands and a dormant ENS switch

Arctic Wolf has revealed that Potassium includes 24 flood commands covering all types of ICMP, TCP, UDP, and OpenVPN. Both the ARM and x86-64 versions of the malware also contain Ethereum Name Service (ENS) lookup functionality — a decentralized naming system that runs on the Ethereum blockchain rather than the traditional DNS hierarchy — but the feature is switched off in both instances. Ethereum and ENS have not been compromised. If activated, however, ENS lookup could make it harder to block the botnet's command servers using conventional DNS and IP controls.

Garbage PoCs versus a working private exploit

Many public proof-of-concept (PoC) exploits fail against production defenses, particularly address space layout randomization (ASLR), a hardening technique that randomizes where a program's code and data sit in memory so exploits cannot reliably target fixed addresses. VulnCheck's Spencer McIntyre described many of the circulating samples as "garbage and nonfunctional," as quoted by The Record.

That protection is not foolproof, though. VulnCheck developed a private exploit that bypasses ASLR on production-configured PHP 8.4.26, later expanding support to selected 8.4 and 8.5 builds. Google's John Hultquist called the threat "viable and very serious," according to The Record.

Why a DDoS botnet worries hosting and crypto operators

The wider threat is already substantial. Cloudflare recorded 935 DDoS attacks exceeding 1 terabit per second during the first half of 2026, according to its threat report. Those attacks were not attributed to Potassium, but they illustrate the disruption facing hosting providers, payment processors, and crypto platforms. No financial losses have been linked to PHP2Shell.

PHP's new advisory and what to watch

On October 23, PHP disclosed another issue, CVE-2026-115560, involving an unusual application configuration. Pending a regular fix, it recommends setting session.upload_progress.enabled=0, a configuration directive that disables PHP's upload-progress feature, which also serves as a mitigation for CVE-2026-109619.

Administrators should install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, restart workers so running processes actually pick up the patched code, and monitor for suspicious downloads. Cobalt CISO Andrew Obadiaru warned that the current quiet period amounts to "borrowed time," as quoted by The Record.