PHP2Shell Scanners Left Their Toolboxes Open, and Hunt.io Looked
Hunt.io combed about ten attacker open directories full of PHP2Shell tooling and a Mirai-style botnet, and published attempt signatures and indicators defenders can search for today.
IOCs
Stories with indicators of compromise: attacker IPs, domains, URLs and file hashes to hunt for and block.
8 stories match your filters.
A Korean-Speaking Crew Is Building a PHP2Shell Hit List
CYFIRMA says Korean-speaking operators are quietly scanning 216 unpatched PHP hosts at governments, banks and logistics firms, with a moderate-confidence Lazarus link.
CriticalCVE-2026-109618CVE-2026-109619 7 Hunt LeadsIOCsRemote AttackerMiraiAmazon Threat Intelligence (AWS Security Blog)
PHP2Shell Was Being Exploited Four Days Before Anyone Knew
Amazon says a PHP2Shell exploit hit its MadPot honeypots on Oct. 17, four days before PHP disclosed CVE-2026-109618 and CVE-2026-109619. It now calls exploitation broad.
Microsoft: China’s Storm-0940 Let AI Agents Run the ConnectWise Hack
Microsoft ties the ConnectWise Cloud Backup supply-chain attack to China-aligned Storm-0940, which used ARTEX AI agents to try sign-ins to more than 2,250 Microsoft 365 tenants at up to 2,900 a minute.
CriticalCVE-2026-0257CVE-2023-27532 5 Hunt LeadsIOCsRemote AttackerQilinINC RansomQilinINC RansomThe Hacker News
Qilin and INC Ransomware Slip Past MFA Through Unpatched PAN-OS
Unit 42 says the Qilin and INC ransomware groups are using CVE-2026-0257, a GlobalProtect authentication bypass patched in May, to open VPN sessions without MFA and then move on to vCenter, ESXi and Veeam.
Plex Servers Are Quietly Mining Crypto for Someone Else
Attackers are chaining four Plex Media Server bugs, now on CISA's exploited list, to drop a cryptominer and a traffic-relay proxy on servers that never got September's fix.
NetScaler Crash Handler Turned Into a Root Shell, Rapid7 Finds
Rapid7 details intrusions where attackers chained CVE-2026-88771 and CVE-2026-88779 to get root on NetScaler ADC and Gateway, then planted HA-aware persistence and stole the appliance's credentials and keys.
CriticalCVE-2026-102764 8 Hunt LeadsYARAIOCsRemote AttackerARMORY CASTLESAWFLYBARECLAWGoogle Threat Intelligence Group / Mandiant
China-Linked Spies Turned BeyondTrust Help Desks Into Skeleton Keys
Google and Mandiant say suspected Chinese espionage group ARMORY CASTLE has exploited a BeyondTrust Remote Support zero-day since late August. Once inside, it took root, dumped stored credentials and used the support tool to reach internal machines.