Attackers Target PHP Servers to Build DDoS Botnet
Researchers have recorded thousands of probes against vulnerable PHP instances as administrators scramble to apply security patches.
Updated on Oct. 24, 2026 in Cybersecurity
Live Poll
Do you trust that major software providers effectively protect your data from evolving cyber threats?
Attackers are attempting to hijack millions of internet-facing PHP servers to build a new DDoS botnet dubbed Potassium. While security researchers have recorded hundreds of thousands of probes against these sites, no successful server compromises have been confirmed to date.
Why it matters
The campaign targets a massive surface area of over 41 million internet-facing PHP services to construct a Mirai-derived network for large-scale distributed denial-of-service attacks. This highlights the rapid exploitation cycle between patch disclosure and real-world malicious probing.
The vulnerabilities CVE-2026-109618 and CVE-2026-109619 carry high severity scores of 9.2. Researchers at VulnCheck have demonstrated a private exploit that bypasses address space layout randomization—a security technique that prevents code execution by randomizing memory locations—on PHP 8.4.26.
The players
PHP
A widely used server-side scripting language that powers a vast portion of the modern web infrastructure.
Imperva
A cybersecurity firm specializing in application security and DDoS protection that monitored the recent probe attempts.
VulnCheck
An exploit intelligence company that develops technical analysis of vulnerabilities and bypass techniques.
Censys
A digital asset search engine that provides visibility into the global inventory of internet-connected devices.
The details
The Potassium malware is designed to turn PHP servers into nodes for a botnet capable of launching flood attacks, including ICMP, TCP, UDP, and Open VPN protocols. It utilizes 24 distinct flood commands to overwhelm target networks. While the malware code includes Ethereum Name Service lookup features, these are currently disabled in the observed samples.
Timeline
October 21, 2026: PHP released security patches for affected versions.
October 22, 2026: Approximately 1 million PHP instances were confirmed as patched.
October 23, 2026: PHP disclosed an additional security configuration issue, CVE-2026-115560.
The Tech Race
The Potassium campaign follows the architecture established by the Mirai botnet to coordinate distributed denial-of-service attacks through large networks of compromised servers. This incident underscores the ongoing race between administrators attempting to deploy patches and attackers weaponizing new vulnerabilities.
System administrators managing internet-facing PHP servers must prioritize installing the patches released on October 21 to mitigate the 9.2 severity vulnerabilities. Users of affected versions are at risk of having their infrastructure utilized for malicious traffic without their consent.
The takeaway
This campaign serves as a reminder to audit server configurations immediately following any security disclosure. Security teams should monitor for anomalous flood command activity and verify their patch deployment status against the 41 million instances currently exposed to potential exploitation.
Further reading
For more on the current state of vulnerability management, see Cybersecurity.
Source note: This article includes information reported by Cryptopolitan.
Live Poll
Do you trust that major software providers effectively protect your data from evolving cyber threats?
