Last seen October 23, 2026

CVE-2026-109618 Security Incident affecting Amazon AWS

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote

Technical Severity
Low severity
Lifecycle Status

NEW

Sources

What Happened

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote

Why This Matters

Publisher reporting describes a security event affecting Millions. BugSkan could not yet bind a CVE or affected version, so treat the source details as the current record.

Recommended Action

Confirm whether Millions is present in your environment, compare your versions against the report, and apply available vendor patches or mitigations.

Exposure

My Interests Exposure

Exposure unknown

Recommended Response
Last Seen

Oct 23, 2026 13:10

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: UNKNOWN

Primary entities:

Amazon AWSAttackers TryDeploy Mirai MalwareExploit Attempts HitMillionsCVE-2026-109618

Authoritative Intelligence

CVE CVE-2026-109618, CVE-2026-109619 Incident identifier

EPSS is a vulnerability exploitation probability signal, not proof that your environment is exposed. CISA KEV means known exploitation of the vulnerability, not that your system was exploited.

Public GitHub References

Search GitHub for public repositories that mention this CVE. BugSkan only lists repository metadata as a defensive awareness signal — it does not fetch or display exploit code.

CVE-2026-109618 on GitHub CVE-2026-109619 on GitHub

Timeline

  • Incident first seen
    Oct 23, 2026 13:10

    BugSkan first recorded this incident.

  • PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
    Oct 23, 2026 13:10

    thehackernews.com · Vulnerability

Sources

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

thehackernews.com · Oct 23, 2026 13:10

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote

Open publisher source

Other BugSkan incidents that share identifiers, products, or vendors with this report.

My Interests Match

Want personalized relevance?

Create an account to see which incidents overlap with your interests.

← Back to incident intelligence