Jetzt wird es ernst: Erste richtige PHP2Shell-Angriffe beobachtet

Jetzt wird es ernst: Erste richtige PHP2Shell-Angriffe beobachtet

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page de/news/winfuture/news-162222-html, snapshot 20261027T094306Z. Copied byte for byte; every file's sha256 is in captures/20261027T094306Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

WinFuture (Germany, German), 27 October: 'Now it gets serious: first real PHP2Shell attacks observed'. It reports that a Perplexity researcher, Adel Karimi, recorded 35 shell processes started on three honeypot systems over the weekend, regarded as the most telling evidence so far that the flaws are used in successful attacks: an earlier analysis of just over 26 hours had found 30 memory errors and eleven worker crashes but no command execution; on 24 October one address caused three shell processes on one system and another was behind 32 spread across all three, and the traffic closely resembled a public proof of concept. No follow-on malware was seen, and Karimi stressed that the setup (PHP 8.4.26, Apache mod_php, one worker) was especially favourable and not transferable to other configurations. The article notes millions of attempts had been logged before without a confirmed code execution.

> Ein nachgeladener Schadcode wurde bei den beobachteten Angriffen aber auch noch nicht festgestellt.

_Curator's translation:_ "No follow-on malware was, however, detected in the observed attacks."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Jetzt wird es ernst: Erste richtige PHP2Shell-Angriffe beobachtet". Selected mechanically, not read by a person.

Capture notes

Language de. Nothing in the page addresses an AI or hides text from a reader.