“However, analysis of the sample revealed that it is an updated and significantly expanded version of the Mirai-derived botnet variant identified in early 2026,”

Sophos · said date not stated · reported 2026-10-23

Sophos analyzed a malware sample linked to the Potassium botnet variant exploiting PHP2Shell vulnerabilities.