PHP2Shell: O colapso da botnet Mirai nas falhas RCE

PHP2Shell: O colapso da botnet Mirai nas falhas RCE

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page br/news/sempreupdate/php2shell-a-anatomia-das-vulnerabilidades-criticas-e-o-fraca, snapshot 20261024T083755Z. Copied byte for byte; every file's sha256 is in captures/20261024T083755Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

SempreUpdate (Brazilian Portuguese, a Linux news site), 23 October, by Emanuel Negromonte: PHP2Shell's anatomy and 'the failure of the Mirai botnet attacks'. It says proof-of-concept exploits became public within hours of the announcement and set off automated scanning, but that consolidated data from Sophos's Counter Threat Unit show the attacks documented so far, mostly aimed at installing a Mirai variant called Potassium, failed to compromise their targets, being stopped by network defences or by configuration dependencies; Sophos first classed some detections as successful compromises but revised that after forensic analysis. It adds that the PHP Foundation issued a supplementary advisory on 23 October confirming a third remote-code-execution flaw, CVE-2026-115560, with the fix left to the regular update cycle because the conditions for exploiting it are very specific. The exploitation conditions and scanner details it gives are left out of the notes.

> A Sophos inicialmente classificou algumas detecções como comprometimentos bem-sucedidos, mas revisou sua avaliação após análises forenses aprofundadas.

_Curator's translation:_ "Sophos initially classified some detections as successful compromises but revised its assessment after in-depth forensic analysis."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell: O colapso da botnet Mirai nas falhas RCE". Selected mechanically, not read by a person.

Capture notes

Language pt-BR. Nothing in the page addresses an AI or hides text from a reader.