PHP2Shell Scanners Left Their Toolboxes Open, and Hunt.io Looked
Hunt.io combed about ten attacker open directories full of PHP2Shell tooling and a Mirai-style botnet, and published attempt signatures and indicators defenders can search for today.
IOCs
Stories with indicators of compromise: attacker IPs, domains, URLs and file hashes to hunt for and block.
2 stories match your filters.
CriticalCVE-2026-109618CVE-2026-109619 7 Hunt LeadsIOCsRemote AttackerMiraiAmazon Threat Intelligence (AWS Security Blog)
PHP2Shell Was Being Exploited Four Days Before Anyone Knew
Amazon says a PHP2Shell exploit hit its MadPot honeypots on Oct. 17, four days before PHP disclosed CVE-2026-109618 and CVE-2026-109619. It now calls exploitation broad.