PHP2Shell (CVE-2026-109618/109619): the first exploitation requests arrived 5.5 hours before PHP released fixes, and the scanning tool carries a Mirai-style loader

On October 21, 2026, PHP released fixed versions for two CVSS 9.2 unauthenticated RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619, codenamed PHP2Shell); the ELLIO sensor captured the first exploitation requests 5.5 hours before the fixes were public, and by 21:00 UTC 31 addresses had sent 705 requests. Both vulnerabilities are triggered during PHP's request parsing stage, requiring no login or application-layer flaw; the fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and 8.1 and earlier have no official fix. Attack tools appeared in batches along with leaked materials, some carrying a Mirai-style loader, delivering a Mirai variant targeting 64-bit servers; the authors judge it to be of the same origin as the potassium family reported by Nokia Deepfield in May; this variant has 22 flooding methods and can attack Minecraft and FiveM servers, but has no self-propagation or persistence.