Unpatched PHP Flaw CVE-2026-109618/109619 Exploited to Spread Mirai-Style Malware

A critical PHP vulnerability, tracked as CVE-2026-109618/109619 and dubbed PHP2Shell, stems from inadequate input sanitization and allows attackers to run arbitrary code on affected servers. Exploit details were published about 5.5 hours before an official patch arrived, giving threat actors a short window to weaponize the flaw. Attackers used Mirai-style loader malware, originally built for IoT botnets, to scan for vulnerable PHP installations, compromise them, and install persistent backdoors. Each compromised machine then became a node in a spreading botnet, enabling rapid, large-scale infection. Security analysts are urging faster patch deployment and stronger threat intelligence to prevent similar coordinated attacks.