Mirai Botnet Operators Target PHP2Shell Flaws

Threat actors attempt to use PHP2Shell vulnerabilities to spread a Mirai botnet variant, but no successful in-the-wild compromise is confirmed. While Sophos and others report failed attempts, a VulnCheck exploit bypasses ASLR on specific systems. Patching lags significantly, with only 199,000 of 110 million instances patched within 12 hours of disclosure on October 21, 2026.