October 24, 2026
- Mass exploitation attempts against CVE-2026-109618/CVE-2026-109619 are being used to push a Mirai variant tracked as Potassium — and none have been observed working. Weaponization is proving harder than the first 48 hours implied, and researchers are now spending as much time debunking claims as tracking them (The Hacker News, The Record). No in-the-wild compromise has been validated; the Dutch NCSC says it is investigating initial signs of successful exploitation (DataBreachToday). This tempers earlier coverage that treated exploitation as established. @mttaggart notes most attack logs circulating online are "folks firing off the GitHub PoCs," and that "the GitHub PoCs are junk." (discussion) · PHP2Shell: Attempts at Scale, Few Landings
in PHP2Shell's Reliability Problem — and a Third, Unpatched PHP Bug