PHP2Shell Scanners Left Their Toolboxes Open, and Hunt.io Looked
Hunt.io combed about ten attacker open directories full of PHP2Shell tooling and a Mirai-style botnet, and published attempt signatures and indicators defenders can search for today.
The Roundup
Security news from around the web with our take: what happened, what it means for you, and what defenders should do. We link every original story.
2 stories match your filters.
CriticalCVE-2026-109618CVE-2026-109619 7 Hunt LeadsIOCsRemote AttackerMiraiAmazon Threat Intelligence (AWS Security Blog)
PHP2Shell Was Being Exploited Four Days Before Anyone Knew
Amazon says a PHP2Shell exploit hit its MadPot honeypots on Oct. 17, four days before PHP disclosed CVE-2026-109618 and CVE-2026-109619. It now calls exploitation broad.