2026-10-22T14:19:17Z https://njump.me OffSequence https://njump.me/npub1dhztq3k0mzavamggh72gdu27suqt2x7enngcr0kxkfa975mk8rsshpk5vz https://media.infosec.exchange/infosec.exchange/accounts/avatars/114/267/265/908/113/668/original/014780c34a5a61f4.png https://media.infosec.exchange/infosec.exchange/accounts/avatars/114/267/265/908/113/668/original/014780c34a5a61f4.png https://njump.me/nevent1qqsvh3ysy3rxt2mvslg72gttzvpasznkd6utgjv4sqh66yx40jk8qrqzypkufvzxelvt4nhdpzlefph3t6rspdgmmxwdrqd7c6e85h6nwcuwz3gy7pg PHP2Shell field report — the attacker-side view.<br/><br/>The first exploit-shaped request hit our Mirage honeypot fleet at 21:57 UTC on 20 Oct, ~16h before the patch embargo lifted. Over the next 48h: 9 source IPs, 7 countries, 2 distinct attack shapes.<br/><br/>Highlights:<br/><br/>One actor swept body size &lt;1KB → 16KB+, 200+ unique payloads in 2 min — live calibration of the OOM trigger<br/>The lead tool stamps ----p2shell&lt;hex&gt; into its multipart boundary: a zero-false-positive detection tell we haven’t seen documented elsewhere<br/>A B8RAT/1.0 actor reaching for the deserialization path (CVE-2026-109619) while others hammer the OOM path (CVE-2026-109618)<br/>Independent confirmation of the pre-disclosure exploitation Amazon &amp; Cloudflare reported, from a second sensor network<br/><br/>Full writeup + IOCs:<br/><a href="https://offseq.com/en/research/php2shell-first-48-hours/">https://offseq.com/en/research/php2shell-first-48-hours/</a><br/><br/>#infosec #PHP2Shell #threatintel #honeypot #PHP #CVE 2026-10-22T13:57:07Z