indicator,type,first_seen,source,reported_by,confidence,context
ashevilleroofingcontractor.com,domain,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
botlesscucks.st,domain,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories,FortiGuard; Hunt.io,high,Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network
checkphp2shell.com,domain,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
fast-xmrig-pool.ru,domain,2026-10-25,https://threatfox.abuse.ch/ioc/142870/,abuse.ch ThreatFox / abuse_ch,high,"Malware: XMRig | Threat: Indicator that identifies a cryptomining pool C&C | Tags: [XMRig, PHP2Shell]"
gettingheadfromduckysmom.st,domain,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/pulse/6ada1e58491e58bb903b7604,FortiGuard; Hunt.io; AlienVault OTX (AlienVault),high,"Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network; Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)"
godofthunder.st,domain,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada1e58491e58bb903b7604; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,FortiGuard; Hunt.io; AlienVault OTX (projectargus); AlienVault OTX (AlienVault),high,"Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network; PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619); Critical PHP Vulnerabilities Enable Remote Code Execution Attacks"
grillmasterchef.com,domain,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
grillrecipespro.com,domain,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
hackattackkaboom.botlesscucks.st,domain,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619; https://otx.alienvault.com/pulse/6adeba5850017607f619cb5c; https://otx.alienvault.com/pulse/6adb676f5630ec8df6eb7117; https://otx.alienvault.com/pulse/6adb5b91d84b3856a2d47615; https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,FortiGuard; Sophos CTU; AlienVault OTX (celestre); AlienVault OTX (CyberHunter_NL); AlienVault OTX (projectargus),high,"Active PHP2Shell exploitation & scanning infrastructure; Potassium Mirai botnet exploitation & C2 infrastructure; IOC - Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619); Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware; Critical PHP Vulnerabilities Exploited Before Public Disclosure; PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks"
hik.gettingheadfromduckysmom.st,domain,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6adeba5850017607f619cb5c; https://otx.alienvault.com/pulse/6adb676f5630ec8df6eb7117; https://otx.alienvault.com/pulse/6adb5b91d84b3856a2d47615; https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,FortiGuard; Sophos CTU; AlienVault OTX; AlienVault OTX (celestre); AlienVault OTX (CyberHunter_NL); AlienVault OTX (projectargus),high,"Active PHP2Shell exploitation & scanning infrastructure; Potassium Mirai botnet exploitation & C2 infrastructure; AlienVault OTX community & threat pulse telemetry; IOC - Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619); Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware; Critical PHP Vulnerabilities Exploited Before Public Disclosure; PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks"
homelygrill.com,domain,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
kiriosyka.com,domain,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
liokida.com,domain,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
malware-stage-cdn.top,domain,2026-10-25,https://threatfox.abuse.ch/ioc/142869/,abuse.ch ThreatFox / abuse_ch,high,"Malware: Mirai | Threat: Indicator that identifies a botnet C&C server | Tags: [Mirai, PHP2Shell]"
maste.mangsud.org,domain,2026-10-22,https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/pulse/6ada1e58491e58bb903b7604,Hunt.io; AlienVault OTX (AlienVault),high,"Open directory staged tooling & scanner network; Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)"
orders-amazon-com.advancedfences.com,domain,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
orders-amazon.com.advancedfences.com,domain,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
perfectgrillrecipes.com,domain,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
php2shell-fix.com,domain,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
php2shell-tracker.com,domain,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
php2shell.online,domain,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
php2shell.pro,domain,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
rootkit.net.cn,domain,2026-10-22,https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,AlienVault OTX (projectargus),high,PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks
stealmybitcoin.com,domain,2026-10-26,https://otx.alienvault.com/pulse/6adecf3db9515a4d8ee40b2d,AlienVault OTX (CyberHunter_NL),high,"Hacker Exploits Critical PHP2Shell Flaws to Win $2,000 Bitcoin Challenge, Releases PoC"
thegrilljournal.com,domain,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
thunder.godofthunder.st,domain,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619; https://otx.alienvault.com/pulse/6adfbe6851cbd0e24cec7144; https://otx.alienvault.com/pulse/6adeba5850017607f619cb5c; https://otx.alienvault.com/pulse/6adb676f5630ec8df6eb7117; https://otx.alienvault.com/pulse/6adb5b91d84b3856a2d47615; https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,FortiGuard; Sophos CTU; AlienVault OTX (CyberHunter_NL); AlienVault OTX (celestre); AlienVault OTX (projectargus),high,"Active PHP2Shell exploitation & scanning infrastructure; Potassium Mirai botnet exploitation & C2 infrastructure; Hackers Weaponize Public PHP2Shell Exploit Code to Target Universities and Business Websites; IOC - Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619); Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware; Critical PHP Vulnerabilities Exploited Before Public Disclosure; PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks"
z-cg.com,domain,2026-10-22,https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,AlienVault OTX (projectargus),high,PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks
102.134.35.141,ip,2026-10-24,https://otx.alienvault.com/pulse/6adc2e1777bc4df2f0f7be51,AlienVault OTX (CyberHunterAutoFeed),high,Twitter Feed - Vega_Threat - 23-10-2026
102.207.250.188,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,FortiGuard; ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Active PHP2Shell exploitation & scanning infrastructure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA
102.210.149.166,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6ada1e58491e58bb903b7604,FortiGuard; Hunt.io; AlienVault OTX; AlienVault OTX (AlienVault),high,"Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network; AlienVault OTX community & threat pulse telemetry; Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)"
103.114.163.188,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://socradar.io/free-tools/ioc-radar/reports/php2shell-critical-php-rce-4b3415825163; https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://otx.alienvault.com/pulse/6ada2405b53c58bd52d0dc31; https://otx.alienvault.com/pulse/6ad9cc6686bcea85910dbd49; https://otx.alienvault.com/pulse/6ad9b9e8858f671a3a732a14,FortiGuard; SOCRadar; Amazon Threat Intelligence; CYFIRMA Research; AlienVault OTX; AlienVault OTX (hiroki); AlienVault OTX (CyberHunter_NL); AlienVault OTX (aziel415); AlienVault OTX (shadowBriefer),high,Active PHP2Shell exploitation & scanning infrastructure; Threat radar PHP2Shell exploitation attempts; Amazon MadPot honeypot telemetry observed prior to public disclosure; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; AlienVault OTX community & threat pulse telemetry; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=AS35913 dedipath; Hackers Were Targeting Critical PHP Vulnerabilities Days Before They Were Patched; Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed - CC=US ASN=AS35913 dedipath; [ShadowBrieferFeed] PHP2Shell Exploitation — CVE-2026-109618 & CVE-2026-109619 | AWS Threat Intelligence - CC=US ASN=AS35913 dedipath
103.147.220.17,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,FortiGuard; Wordfence Threat Intelligence; AlienVault OTX,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse; AlienVault OTX community & threat pulse telemetry
103.152.220.155,ip,2026-10-23,https://threatfox.abuse.ch/ioc/142862/,abuse.ch ThreatFox / abuse_ch,high,"Malware: Potassium | Threat: Indicator that identifies a botnet C&C server | Tags: [Potassium, PHP2Shell, CVE-2026-109618]; port: 443"
103.21.161.105,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,FortiGuard; ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Active PHP2Shell exploitation & scanning infrastructure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=IN ASN=AS45916 gujarat telelink pvt ltd
103.216.220.92,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://socradar.io/free-tools/ioc-radar/reports/php2shell-critical-php-rce-4b3415825163; https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://otx.alienvault.com/pulse/6ada2405b53c58bd52d0dc31; https://otx.alienvault.com/pulse/6ad9cc6686bcea85910dbd49; https://otx.alienvault.com/pulse/6ad9b9e8858f671a3a732a14,FortiGuard; SOCRadar; Amazon Threat Intelligence; ThreatLandscape; CYFIRMA Research; AlienVault OTX; AlienVault OTX (hiroki); AlienVault OTX (CyberHunter_NL); AlienVault OTX (aziel415); AlienVault OTX (shadowBriefer),high,Active PHP2Shell exploitation & scanning infrastructure; Threat radar PHP2Shell exploitation attempts; Amazon MadPot honeypot telemetry observed prior to public disclosure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; AlienVault OTX community & threat pulse telemetry; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=AU ASN=AS136557 host universal pty ltd; Hackers Were Targeting Critical PHP Vulnerabilities Days Before They Were Patched; Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed - CC=AU ASN=AS136557 host universal pty ltd; [ShadowBrieferFeed] PHP2Shell Exploitation — CVE-2026-109618 & CVE-2026-109619 | AWS Threat Intelligence - CC=AU ASN=AS136557 host universal pty ltd
103.77.210.80,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; CYFIRMA Research; AlienVault OTX (AlienVault); AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=IN ASN=ASNone
104.219.251.31,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6ada1e58491e58bb903b7604,FortiGuard; Hunt.io; AlienVault OTX; AlienVault OTX (AlienVault),high,"Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network; AlienVault OTX community & threat pulse telemetry; Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)"
104.238.38.202,ip,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
104.28.220.174,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
107.128.150.156,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
107.150.31.151,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,FortiGuard; Hunt.io; AlienVault OTX,high,Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network; AlienVault OTX community & threat pulse telemetry
107.189.14.87,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,FortiGuard; Wordfence Threat Intelligence; AlienVault OTX,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse; AlienVault OTX community & threat pulse telemetry
109.56.219.150,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,FortiGuard; ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Active PHP2Shell exploitation & scanning infrastructure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=DK ASN=AS44034 hi3g access ab
109.71.252.97,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.vulncheck.com/blog/php2shell-vulnerabilities#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,FortiGuard; VulnCheck; CYFIRMA Research; AlienVault OTX (hiroki),high,Active PHP2Shell exploitation & scanning infrastructure; VulnCheck intelligence on PHP2Shell exploitation & payload hashes; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=DE ASN=AS206638 pe brezhnev daniil
115.96.27.126,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,FortiGuard; ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Active PHP2Shell exploitation & scanning infrastructure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=IN ASN=AS17488 hathway ip over cable internet
116.98.243.14,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://jorgeliauw.nl/posts/php2shell-google-threat-intelligence-iocs-secops-detections/,FortiGuard; Jorge Liauw / Google Threat Intelligence,high,Active PHP2Shell exploitation & scanning infrastructure; Google Threat Intelligence & SecOps detections for PHP2Shell
117.203.73.63,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; CYFIRMA Research; AlienVault OTX (AlienVault); AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=IN ASN=AS9829 national internet backbone
117.55.202.115,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619; https://otx.alienvault.com/pulse/6adeba5850017607f619cb5c; https://otx.alienvault.com/pulse/6adb676f5630ec8df6eb7117; https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,FortiGuard; Sophos CTU; AlienVault OTX (celestre); AlienVault OTX (CyberHunter_NL); AlienVault OTX (projectargus),high,"Active PHP2Shell exploitation & scanning infrastructure; Potassium Mirai botnet exploitation & C2 infrastructure; IOC - Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) - CC=AF ASN=AS55745 neda telecommunications; Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware; PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks"
119.63.72.54,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,FortiGuard; ThreatLandscape; CYFIRMA Research; AlienVault OTX (AlienVault); AlienVault OTX (hiroki),high,Active PHP2Shell exploitation & scanning infrastructure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=TH ASN=AS38794 uih
122.10.110.72,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6ada1e58491e58bb903b7604,FortiGuard; Hunt.io; AlienVault OTX; AlienVault OTX (AlienVault),high,"Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network; AlienVault OTX community & threat pulse telemetry; Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)"
122.10.130.72,ip,2026-10-26,https://otx.alienvault.com/pulse/6adfbe6851cbd0e24cec7144,AlienVault OTX (CyberHunter_NL),high,Hackers Weaponize Public PHP2Shell Exploit Code to Target Universities and Business Websites
122.10.17.49,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,FortiGuard; Hunt.io; AlienVault OTX,high,Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network; AlienVault OTX community & threat pulse telemetry
124.122.142.142,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,FortiGuard; ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Active PHP2Shell exploitation & scanning infrastructure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=TH ASN=AS17552 true online
124.221.46.164,ip,2026-10-26,https://otx.alienvault.com/pulse/6adfbe6851cbd0e24cec7144,AlienVault OTX (CyberHunter_NL),high,Hackers Weaponize Public PHP2Shell Exploit Code to Target Universities and Business Websites
125.21.250.66,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
128.90.176.13,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=AS22363 powerhouse management  inc.
134.122.38.73,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=AS14061 digitalocean  llc
134.154.64.199,ip,2026-10-22,https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,AlienVault OTX (projectargus),high,PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks
134.199.154.64,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619; https://otx.alienvault.com/pulse/6adeba5850017607f619cb5c; https://otx.alienvault.com/pulse/6adb676f5630ec8df6eb7117,FortiGuard; Sophos CTU; AlienVault OTX (celestre); AlienVault OTX (CyberHunter_NL),high,"Active PHP2Shell exploitation & scanning infrastructure; port: 50792; Potassium Mirai botnet exploitation & C2 infrastructure; IOC - Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) - CC=CA ASN=ASNone; Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware"
134.209.159.64,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://socradar.io/free-tools/ioc-radar/reports/php2shell-critical-php-rce-4b3415825163; https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://otx.alienvault.com/pulse/6ada2405b53c58bd52d0dc31; https://otx.alienvault.com/pulse/6ad9cc6686bcea85910dbd49; https://otx.alienvault.com/pulse/6ad9b9e8858f671a3a732a14,FortiGuard; SOCRadar; Amazon Threat Intelligence; CYFIRMA Research; AlienVault OTX; AlienVault OTX (hiroki); AlienVault OTX (CyberHunter_NL); AlienVault OTX (aziel415); AlienVault OTX (shadowBriefer),high,Active PHP2Shell exploitation & scanning infrastructure; Threat radar PHP2Shell exploitation attempts; Amazon MadPot honeypot telemetry observed prior to public disclosure; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; AlienVault OTX community & threat pulse telemetry; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=AS14061 digitalocean  llc; Hackers Were Targeting Critical PHP Vulnerabilities Days Before They Were Patched; Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed - CC=US ASN=AS14061 digitalocean  llc; [ShadowBrieferFeed] PHP2Shell Exploitation — CVE-2026-109618 & CVE-2026-109619 | AWS Threat Intelligence - CC=US ASN=AS14061 digitalocean  llc
134.209.181.133,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,FortiGuard; ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Active PHP2Shell exploitation & scanning infrastructure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=AS14061 digitalocean  llc
134.209.252.157,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,FortiGuard; ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Active PHP2Shell exploitation & scanning infrastructure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=AS14061 digitalocean  llc
135.136.21.120,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
137.23.10.39,ip,2026-10-23,https://otx.alienvault.com/pulse/6adad519461d6534b74900ad,AlienVault OTX (CyberHunterAutoFeed),high,Twitter Feed - LukeElin - 22-10-2026
138.124.67.192,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
138.199.34.201,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,FortiGuard; ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Active PHP2Shell exploitation & scanning infrastructure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=SK ASN=AS212238 datacamp limited
138.3.211.255,ip,2026-10-23,https://otx.alienvault.com/pulse/6adad519461d6534b74900ad,AlienVault OTX (CyberHunterAutoFeed),high,Twitter Feed - LukeElin - 22-10-2026
138.68.161.170,ip,2026-10-21,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://fortiguard.fortinet.com/outbreak-alert/php2shell,ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki); FortiGuard,high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=GB ASN=AS14061 digitalocean  llc; Active PHP2Shell exploitation & scanning infrastructure
139.162.165.136,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,FortiGuard; Hunt.io; AlienVault OTX,high,Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network; AlienVault OTX community & threat pulse telemetry
140.245.32.169,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/,FortiGuard; Wordfence Threat Intelligence,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse
142.93.155.162,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=CA ASN=AS14061 digitalocean  llc
143.246.213.138,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=AS600 oarnet
143.246.223.124,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/,FortiGuard; Wordfence Threat Intelligence,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse
144.172.64.128,ip,2026-10-21,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6ad9eb3e5a8fa9121e8ab038,OffSeq Radar; AlienVault OTX; AlienVault OTX (AlienVault),high,OffSeq Threat Radar observed active exploitation infrastructure; AlienVault OTX community & threat pulse telemetry; Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot - CC=US ASN=AS8100 quadranet enterprises llc
144.172.64.60,ip,2026-10-21,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6ad9eb3e5a8fa9121e8ab038,OffSeq Radar; AlienVault OTX; AlienVault OTX (AlienVault),high,OffSeq Threat Radar observed active exploitation infrastructure; AlienVault OTX community & threat pulse telemetry; Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot - CC=US ASN=AS8100 quadranet enterprises llc
144.172.64.99,ip,2026-10-21,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6ad9eb3e5a8fa9121e8ab038,OffSeq Radar; AlienVault OTX; AlienVault OTX (AlienVault),high,OffSeq Threat Radar observed active exploitation infrastructure; AlienVault OTX community & threat pulse telemetry; Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot - CC=US ASN=AS8100 quadranet enterprises llc
144.91.70.51,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=DE ASN=AS51167 contabo gmbh
145.255.150.25,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; CYFIRMA Research; AlienVault OTX (AlienVault); AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=SK ASN=AS35328 dsi data  a. s.
146.190.107.103,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=ASNone
146.70.114.180,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=SK ASN=AS9009 m247 ltd
146.70.114.182,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=SK ASN=AS9009 m247 ltd
146.70.194.93,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=RO ASN=ASNone
146.70.202.189,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
147.175.149.67,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; CYFIRMA Research; AlienVault OTX (AlienVault); AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=SK ASN=AS2607 zdruzenie pouzivatelov slovenskej akademickej datovej siete
147.78.168.57,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,FortiGuard; ThreatLandscape; CYFIRMA Research; AlienVault OTX (AlienVault); AlienVault OTX (hiroki),high,Active PHP2Shell exploitation & scanning infrastructure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=SK ASN=AS209531 obecne siete  s.r.o.
147.78.168.67,ip,2026-10-24,https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,CYFIRMA Research; AlienVault OTX (AlienVault); AlienVault OTX (hiroki),high,Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=SK ASN=AS209531 obecne siete  s.r.o.
149.102.232.44,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=AS174 cogent communications
149.102.232.93,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=AS174 cogent communications
150.251.112.208,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,FortiGuard; AlienVault OTX (projectargus),high,Active PHP2Shell exploitation & scanning infrastructure; PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks
151.253.243.219,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=AE ASN=AS5384 emirates telecommunications corporation
152.233.51.69,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,FortiGuard; Wordfence Threat Intelligence; AlienVault OTX,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse; AlienVault OTX community & threat pulse telemetry
152.237.230.29,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=BR ASN=AS7738 telemar norte leste s.a.
157.230.117.70,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,FortiGuard; Hunt.io; AlienVault OTX,high,Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network; AlienVault OTX community & threat pulse telemetry
158.173.242.133,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=DK ASN=AS3292 tdc a s
158.173.75.178,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,FortiGuard; ThreatLandscape; CYFIRMA Research; AlienVault OTX (AlienVault); AlienVault OTX (hiroki),high,Active PHP2Shell exploitation & scanning infrastructure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=DK ASN=AS3292 tdc a s
158.179.191.73,ip,2026-10-23,https://otx.alienvault.com/pulse/6adad519461d6534b74900ad,AlienVault OTX (CyberHunterAutoFeed),high,Twitter Feed - LukeElin - 22-10-2026
159.223.59.200,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=AS14061 digitalocean  llc
165.22.232.198,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=CA ASN=AS14061 digitalocean  llc
167.148.201.106,ip,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
167.254.242.130,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/,FortiGuard; Wordfence Threat Intelligence,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse
169.58.138.154,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
170.64.224.137,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=ASNone
170.64.226.40,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=ASNone
171.226.224.101,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
173.249.16.178,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=DE ASN=AS51167 contabo gmbh
173.249.16.192,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=DE ASN=AS51167 contabo gmbh
176.236.127.109,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://jorgeliauw.nl/posts/php2shell-google-threat-intelligence-iocs-secops-detections/,FortiGuard; Jorge Liauw / Google Threat Intelligence,high,Active PHP2Shell exploitation & scanning infrastructure; Google Threat Intelligence & SecOps detections for PHP2Shell
176.236.127.37,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://jorgeliauw.nl/posts/php2shell-google-threat-intelligence-iocs-secops-detections/,FortiGuard; Jorge Liauw / Google Threat Intelligence,high,Active PHP2Shell exploitation & scanning infrastructure; Google Threat Intelligence & SecOps detections for PHP2Shell
176.65.132.128,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
177.75.57.20,ip,2026-10-23,https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210,AlienVault OTX (projectargus),high,PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches
18.68.23.52,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
181.215.186.252,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,FortiGuard; Wordfence Threat Intelligence; AlienVault OTX,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse; AlienVault OTX community & threat pulse telemetry
185.157.109.60,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=EE ASN=AS202652 elevi as
185.161.210.29,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,FortiGuard; Wordfence Threat Intelligence; AlienVault OTX,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse; AlienVault OTX community & threat pulse telemetry
185.196.220.132,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,FortiGuard; Wordfence Threat Intelligence; AlienVault OTX,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse; AlienVault OTX community & threat pulse telemetry
185.196.8.99,ip,2026-10-23,https://threatfox.abuse.ch/ioc/142857/,abuse.ch ThreatFox / abuse_ch,high,"Malware: Mirai | Threat: Indicator that identifies a botnet C&C server | Tags: [Mirai, PHP2Shell, CVE-2026-109618]; port: 38124"
185.203.18.54,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; CYFIRMA Research; AlienVault OTX (AlienVault); AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=HR ASN=AS61211 setcor d.o.o.
185.207.232.121,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=BG ASN=AS41366 komax ood
185.218.86.14,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
185.235.212.105,ip,2026-10-21,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://fortiguard.fortinet.com/outbreak-alert/php2shell,ThreatLandscape; CYFIRMA Research; AlienVault OTX (AlienVault); AlienVault OTX (hiroki); FortiGuard,high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=HR ASN=AS39416 infoart d.o.o.; Active PHP2Shell exploitation & scanning infrastructure
185.5.70.233,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,FortiGuard; AlienVault OTX (projectargus),high,Active PHP2Shell exploitation & scanning infrastructure; PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks
187.15.88.186,ip,2026-10-21,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6ad9eb3e5a8fa9121e8ab038,OffSeq Radar; AlienVault OTX; AlienVault OTX (AlienVault),high,OffSeq Threat Radar observed active exploitation infrastructure; AlienVault OTX community & threat pulse telemetry; Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot - CC=BR ASN=AS7738 telemar norte leste s.a.
187.15.89.186,ip,2026-10-21,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6ad9eb3e5a8fa9121e8ab038,OffSeq Radar; AlienVault OTX; AlienVault OTX (AlienVault),high,OffSeq Threat Radar observed active exploitation infrastructure; AlienVault OTX community & threat pulse telemetry; Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot - CC=BR ASN=AS7738 telemar norte leste s.a.
187.15.90.217,ip,2026-10-21,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6ad9eb3e5a8fa9121e8ab038,OffSeq Radar; AlienVault OTX; AlienVault OTX (AlienVault),high,OffSeq Threat Radar observed active exploitation infrastructure; AlienVault OTX community & threat pulse telemetry; Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot - CC=BR ASN=AS7738 telemar norte leste s.a.
188.80.228.122,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; CYFIRMA Research; AlienVault OTX (AlienVault); AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=PT ASN=AS3243 meo servicos de comunicacoes e multimedia sa
192.177.131.13,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=AS64267 sprious llc
192.9.176.139,ip,2026-10-23,https://otx.alienvault.com/pulse/6adad519461d6534b74900ad,AlienVault OTX (CyberHunterAutoFeed),high,Twitter Feed - LukeElin - 22-10-2026
193.142.146.35,ip,2026-10-24,https://threatfox.abuse.ch/ioc/142864/,abuse.ch ThreatFox / abuse_ch,high,"Malware: RedTail | Threat: Indicator that identifies a botnet C&C server | Tags: [RedTail, PHP2Shell]; port: 5555"
193.142.147.111,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/,FortiGuard; Wordfence Threat Intelligence,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse
193.188.113.170,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
193.47.62.24,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/,FortiGuard; Wordfence Threat Intelligence,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse
194.38.20.10,ip,2026-10-24,https://threatfox.abuse.ch/ioc/142858/,abuse.ch ThreatFox / abuse_ch,high,"Malware: XMRig | Threat: Indicator that identifies payload delivery infrastructure | Tags: [XMRig, PHP2Shell]; port: 80"
194.42.196.44,ip,2026-10-21,https://offseq.com/en/research/php2shell-first-48-hours/#s-10,OffSeq Research,high,OffSeq Mirage honeypot fleet observed initial 48-hour probes
195.245.112.63,ip,2026-10-26,https://otx.alienvault.com/pulse/6adfbe6851cbd0e24cec7144,AlienVault OTX (CyberHunter_NL),high,Hackers Weaponize Public PHP2Shell Exploit Code to Target Universities and Business Websites
195.26.253.254,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
197.162.187.47,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
197.54.157.115,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
20.204.28.90,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
20.61.126.211,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
203.78.119.133,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/,FortiGuard; Wordfence Threat Intelligence,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse
204.76.203.7,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,FortiGuard; AlienVault OTX,high,Active PHP2Shell exploitation & scanning infrastructure; AlienVault OTX community & threat pulse telemetry
205.147.28.39,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
206.188.197.105,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6adfbe6851cbd0e24cec7144; https://otx.alienvault.com/pulse/6adb5b91d84b3856a2d47615; https://otx.alienvault.com/pulse/6ada1e58491e58bb903b7604,FortiGuard; Hunt.io; AlienVault OTX; AlienVault OTX (CyberHunter_NL); AlienVault OTX (projectargus); AlienVault OTX (AlienVault),high,"Active PHP2Shell exploitation & scanning infrastructure; port: 9999; Open directory staged tooling & scanner network; AlienVault OTX community & threat pulse telemetry; Hackers Weaponize Public PHP2Shell Exploit Code to Target Universities and Business Websites; Critical PHP Vulnerabilities Exploited Before Public Disclosure; Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)"
209.126.84.8,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
211.240.117.200,ip,2026-10-23,https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210,AlienVault OTX (projectargus),high,PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches
217.112.152.168,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/,FortiGuard; Wordfence Threat Intelligence,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse
217.160.132.82,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,FortiGuard; Hunt.io; AlienVault OTX,high,Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network; AlienVault OTX community & threat pulse telemetry
217.60.102.5,ip,2026-10-24,https://otx.alienvault.com/pulse/6adc2e119e6d0bfd200334c6,AlienVault OTX (CyberHunterAutoFeed),high,Twitter Feed - Huntbackio - 23-10-2026
217.60.196.124,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=IR ASN=AS43212 pejvak ertebatat atiyeh roshan company (p.j.s.)
217.60.242.58,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
217.60.242.76,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://offseq.com/en/research/php2shell-first-48-hours/#s-10; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6adc2e119e6d0bfd200334c6,FortiGuard; OffSeq Research; AlienVault OTX; AlienVault OTX (CyberHunterAutoFeed),high,Active PHP2Shell exploitation & scanning infrastructure; OffSeq Mirage honeypot fleet observed initial 48-hour probes; AlienVault OTX community & threat pulse telemetry; Twitter Feed - Huntbackio - 23-10-2026
221.14.159.134,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c; https://www.vulncheck.com/blog/php2shell-vulnerabilities#indicators-of-compromise; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6ad91a624dfadf973556516c,FortiGuard; OffSeq Radar; VulnCheck; AlienVault OTX; AlienVault OTX (AlienVault),high,Active PHP2Shell exploitation & scanning infrastructure; OffSeq Threat Radar observed active exploitation infrastructure; VulnCheck intelligence on PHP2Shell exploitation & payload hashes; AlienVault OTX community & threat pulse telemetry; PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619
23.106.131.214,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=AS25820 it7 networks inc
23.226.136.36,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
2409:40d2:204e:4be:2a1f:f9c9:a055:e00b,ip,2026-10-21,https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6adb5b91d84b3856a2d47615,Wordfence Threat Intelligence; AlienVault OTX; AlienVault OTX (projectargus),high,Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse; AlienVault OTX community & threat pulse telemetry; Critical PHP Vulnerabilities Exploited Before Public Disclosure
31.223.184.166,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://socradar.io/free-tools/ioc-radar/reports/php2shell-critical-php-rce-4b3415825163; https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://otx.alienvault.com/pulse/6ada2405b53c58bd52d0dc31; https://otx.alienvault.com/pulse/6ad9cc6686bcea85910dbd49; https://otx.alienvault.com/pulse/6ad9b9e8858f671a3a732a14,FortiGuard; SOCRadar; Amazon Threat Intelligence; CYFIRMA Research; AlienVault OTX; AlienVault OTX (AlienVault); AlienVault OTX (hiroki); AlienVault OTX (CyberHunter_NL); AlienVault OTX (aziel415); AlienVault OTX (shadowBriefer),high,Active PHP2Shell exploitation & scanning infrastructure; Threat radar PHP2Shell exploitation attempts; Amazon MadPot honeypot telemetry observed prior to public disclosure; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; AlienVault OTX community & threat pulse telemetry; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=JP ASN=AS199524 g-core labs s.a.; Hackers Were Targeting Critical PHP Vulnerabilities Days Before They Were Patched; Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed - CC=JP ASN=AS199524 g-core labs s.a.; [ShadowBrieferFeed] PHP2Shell Exploitation — CVE-2026-109618 & CVE-2026-109619 | AWS Threat Intelligence - CC=JP ASN=AS199524 g-core labs s.a.
34.19.34.88,ip,2026-10-21,https://offseq.com/en/research/php2shell-first-48-hours/#s-10,OffSeq Research,high,OffSeq Mirage honeypot fleet observed initial 48-hour probes
34.76.218.47,ip,2026-10-21,https://offseq.com/en/research/php2shell-first-48-hours/#s-10,OffSeq Research,high,OffSeq Mirage honeypot fleet observed initial 48-hour probes
34.76.232.95,ip,2026-10-21,https://offseq.com/en/research/php2shell-first-48-hours/#s-10,OffSeq Research,high,OffSeq Mirage honeypot fleet observed initial 48-hour probes
35.237.88.125,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
37.19.200.5,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://socradar.io/free-tools/ioc-radar/reports/php2shell-critical-php-rce-4b3415825163; https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://otx.alienvault.com/pulse/6ada2405b53c58bd52d0dc31; https://otx.alienvault.com/pulse/6ad9cc6686bcea85910dbd49; https://otx.alienvault.com/pulse/6ad9b9e8858f671a3a732a14,FortiGuard; SOCRadar; Amazon Threat Intelligence; CYFIRMA Research; AlienVault OTX; AlienVault OTX (hiroki); AlienVault OTX (CyberHunter_NL); AlienVault OTX (aziel415); AlienVault OTX (shadowBriefer),high,Active PHP2Shell exploitation & scanning infrastructure; Threat radar PHP2Shell exploitation attempts; Amazon MadPot honeypot telemetry observed prior to public disclosure; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; AlienVault OTX community & threat pulse telemetry; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=US ASN=AS212238 datacamp limited; Hackers Were Targeting Critical PHP Vulnerabilities Days Before They Were Patched; Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed - CC=US ASN=AS212238 datacamp limited; [ShadowBrieferFeed] PHP2Shell Exploitation — CVE-2026-109618 & CVE-2026-109619 | AWS Threat Intelligence - CC=US ASN=AS212238 datacamp limited
38.180.45.91,ip,2026-10-21,https://offseq.com/en/research/php2shell-first-48-hours/#s-10,OffSeq Research,high,OffSeq Mirage honeypot fleet observed initial 48-hour probes
41.223.30.7,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6adfbe6851cbd0e24cec7144; https://otx.alienvault.com/pulse/6adb5b91d84b3856a2d47615; https://otx.alienvault.com/pulse/6ada1e58491e58bb903b7604,FortiGuard; Hunt.io; AlienVault OTX; AlienVault OTX (CyberHunter_NL); AlienVault OTX (projectargus); AlienVault OTX (AlienVault),high,"Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network; AlienVault OTX community & threat pulse telemetry; Hackers Weaponize Public PHP2Shell Exploit Code to Target Universities and Business Websites; Critical PHP Vulnerabilities Exploited Before Public Disclosure; Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)"
45.115.26.26,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.134.225.16,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,FortiGuard; Wordfence Threat Intelligence; AlienVault OTX,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse; AlienVault OTX community & threat pulse telemetry
45.136.71.89,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.148.10.201,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=NL ASN=AS48090 pptechnology limited
45.148.10.80,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=NL ASN=AS48090 pptechnology limited
45.154.255.89,ip,2026-10-24,https://threatfox.abuse.ch/ioc/142863/,abuse.ch ThreatFox (threatfox_abusech),high,"Malware: Mirai | Threat: Indicator that identifies payload delivery infrastructure | Tags: [Mirai, PHP2Shell]; port: 8080"
45.156.128.41,ip,2026-10-21,https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,AlienVault OTX,high,AlienVault OTX community & threat pulse telemetry
45.156.128.43,ip,2026-10-21,https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,AlienVault OTX,high,AlienVault OTX community & threat pulse telemetry
45.156.129.48,ip,2026-10-21,https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,AlienVault OTX,high,AlienVault OTX community & threat pulse telemetry
45.156.129.54,ip,2026-10-21,https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,AlienVault OTX,high,AlienVault OTX community & threat pulse telemetry
45.156.129.57,ip,2026-10-21,https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,AlienVault OTX,high,AlienVault OTX community & threat pulse telemetry
45.156.131.22,ip,2026-10-21,https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,AlienVault OTX,high,AlienVault OTX community & threat pulse telemetry
45.198.224.10,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.110,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.114,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.115,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.12,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.120,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.126,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.127,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.13,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.130,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.134,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.136,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.138,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.140,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.141,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.143,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.144,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.145,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.147,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.148,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.15,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.151,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.155,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.157,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.169,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/; https://www.vulncheck.com/blog/php2shell-vulnerabilities#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6adeba5850017607f619cb5c; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://otx.alienvault.com/pulse/6adb676f5630ec8df6eb7117,FortiGuard; Arctic Wolf Labs; VulnCheck; CYFIRMA Research; Sophos CTU; Hunt.io; AlienVault OTX; AlienVault OTX (celestre); AlienVault OTX (hiroki); AlienVault OTX (CyberHunter_NL),high,"Active PHP2Shell exploitation & scanning infrastructure; Observed PHP2Shell exploitation attempts & dropper hashes; VulnCheck intelligence on PHP2Shell exploitation & payload hashes; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Potassium Mirai botnet exploitation & C2 infrastructure; Open directory staged tooling & scanner network; AlienVault OTX community & threat pulse telemetry; IOC - Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) - CC=ZA ASN=AS23674 nayatel (pvt) ltd; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=ZA ASN=AS23674 nayatel (pvt) ltd; Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware"
45.198.224.17,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.18,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.182,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.186,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.188,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.19,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.190,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.191,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.21,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.210,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.211,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.212,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.213,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.214,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.215,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.22,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.23,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.233,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.234,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.236,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.237,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.240,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.241,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.242,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.243,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.244,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.245,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.246,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.247,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.249,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.25,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.254,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.26,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.38,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.4,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.41,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.42,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.43,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.44,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.45,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.46,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.5,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.53,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.55,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.59,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.60,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.62,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.7,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.8,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.81,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.85,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.88,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories,FortiGuard; Hunt.io,high,Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network
45.198.224.9,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.92,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.93,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.94,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.198.224.96,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
45.244.42.195,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
47.100.125.108,ip,2026-10-21,https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,Hunt.io; AlienVault OTX,high,Open directory staged tooling & scanner network; AlienVault OTX community & threat pulse telemetry
49.87.220.67,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://jorgeliauw.nl/posts/php2shell-google-threat-intelligence-iocs-secops-detections/,FortiGuard; Jorge Liauw / Google Threat Intelligence,high,Active PHP2Shell exploitation & scanning infrastructure; Google Threat Intelligence & SecOps detections for PHP2Shell
5.175.189.76,ip,2026-10-23,https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/,Arctic Wolf Labs,high,Observed PHP2Shell exploitation attempts & dropper hashes
5.255.114.109,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=NL ASN=AS60404 the infrastructure group b.v.
52.74.54.75,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/,FortiGuard; Wordfence Threat Intelligence,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse
54.152.33.170,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
54.169.109.7,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,FortiGuard; Hunt.io; AlienVault OTX,high,Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network; AlienVault OTX community & threat pulse telemetry
58.221.60.160,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/pulse/6ada1e58491e58bb903b7604,FortiGuard; Hunt.io; AlienVault OTX (AlienVault),high,"Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network; Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)"
64.199.134.154,ip,2026-10-22,https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,AlienVault OTX (projectargus),high,PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks
65.49.200.56,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/,FortiGuard; Wordfence Threat Intelligence,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse
75.119.143.189,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=DE ASN=AS51167 contabo gmbh
77.90.185.20,ip,2026-10-21,https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6adc2e119e6d0bfd200334c6,AlienVault OTX; AlienVault OTX (CyberHunterAutoFeed),high,AlienVault OTX community & threat pulse telemetry; Twitter Feed - Huntbackio - 23-10-2026
78.17.70.38,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
78.47.85.99,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,FortiGuard; ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Active PHP2Shell exploitation & scanning infrastructure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=DE ASN=AS24940 hetzner online gmbh
80.66.66.66,ip,2026-10-21,https://offseq.com/en/research/php2shell-first-48-hours/#s-10,OffSeq Research,high,OffSeq Mirage honeypot fleet observed initial 48-hour probes
81.17.100.107,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
85.106.184.220,ip,2026-10-23,https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce,Zscaler ThreatLabz,high,Zscaler ThreatLabz in-the-wild exploitation analysis and payload telemetry
85.11.163.243,ip,2026-10-26,https://otx.alienvault.com/pulse/6adfbe6851cbd0e24cec7144,AlienVault OTX (CyberHunter_NL),high,Hackers Weaponize Public PHP2Shell Exploit Code to Target Universities and Business Websites
85.11.167.243,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.vulncheck.com/blog/php2shell-vulnerabilities#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6adfbe6851cbd0e24cec7144; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://otx.alienvault.com/pulse/6adc2e119e6d0bfd200334c6,FortiGuard; VulnCheck; CYFIRMA Research; Hunt.io; AlienVault OTX; AlienVault OTX (CyberHunter_NL); AlienVault OTX (hiroki); AlienVault OTX (CyberHunterAutoFeed),high,Active PHP2Shell exploitation & scanning infrastructure; VulnCheck intelligence on PHP2Shell exploitation & payload hashes; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Open directory staged tooling & scanner network; AlienVault OTX community & threat pulse telemetry; Hackers Weaponize Public PHP2Shell Exploit Code to Target Universities and Business Websites; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=BG ASN=AS207144 sofcompany ltd; Twitter Feed - Huntbackio - 23-10-2026
85.137.53.26,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/,FortiGuard; Wordfence Threat Intelligence,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse
85.137.56.188,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/,FortiGuard; Wordfence Threat Intelligence,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse
87.121.84.174,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.wordfence.com/blog/2026/10/attacks-on-php2shell-continue-but-no-known-compromises-as-a-result-yet/; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,FortiGuard; Wordfence Threat Intelligence; AlienVault OTX,high,Active PHP2Shell exploitation & scanning infrastructure; Top attacking IP blocked by Wordfence Firewall for PHP2Shell / upload progress abuse; AlienVault OTX community & threat pulse telemetry
87.192.237.19,ip,2026-10-21,https://offseq.com/en/research/php2shell-first-48-hours/#s-10,OffSeq Research,high,OffSeq Mirage honeypot fleet observed initial 48-hour probes
89.208.103.220,ip,2026-10-25,https://threatfox.abuse.ch/ioc/142865/,abuse.ch ThreatFox / abuse_ch,high,"Malware: PHP2Shell Dropper | Threat: Indicator that identifies payload delivery infrastructure | Tags: [PHP2Shell, CVE-2026-109618]; port: 80"
89.32.41.16,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/pulse/6ada1e58491e58bb903b7604,FortiGuard; Hunt.io; AlienVault OTX (AlienVault),high,"Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network; Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)"
89.32.41.50,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/pulse/6ada1e58491e58bb903b7604,FortiGuard; Hunt.io; AlienVault OTX (AlienVault),high,"Active PHP2Shell exploitation & scanning infrastructure; Open directory staged tooling & scanner network; Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)"
91.90.123.25,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.vulncheck.com/blog/php2shell-vulnerabilities#indicators-of-compromise; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories,FortiGuard; VulnCheck; Hunt.io,low,Active PHP2Shell exploitation & scanning infrastructure; VulnCheck intelligence on PHP2Shell exploitation & payload hashes; Security research probe / verification scanner (php2shell-verify/1.0); Open directory staged tooling & scanner network
91.90.123.5,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
92.118.112.100,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619; https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6adeba5850017607f619cb5c; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://otx.alienvault.com/pulse/6adb676f5630ec8df6eb7117; https://otx.alienvault.com/pulse/6adb5b91d84b3856a2d47615; https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada1e58491e58bb903b7604; https://otx.alienvault.com/pulse/6adb23532c6b919b727c347d; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,FortiGuard; Arctic Wolf Labs; ThreatLandscape; CYFIRMA Research; Sophos CTU; Hunt.io; AlienVault OTX; AlienVault OTX (AlienVault); AlienVault OTX (celestre); AlienVault OTX (hiroki); AlienVault OTX (CyberHunter_NL); AlienVault OTX (projectargus),high,"Active PHP2Shell exploitation & scanning infrastructure; Observed PHP2Shell exploitation attempts & dropper hashes; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Potassium Mirai botnet exploitation & C2 infrastructure; Open directory staged tooling & scanner network; AlienVault OTX community & threat pulse telemetry; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; IOC - Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) - CC=RU ASN=AS57494 adman llc; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=RU ASN=AS57494 adman llc; Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware; Critical PHP Vulnerabilities Exploited Before Public Disclosure; PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619); Critical PHP Vulnerabilities Prompt Global Website Shutdowns; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks"
94.154.42.149,ip,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,ThreatLandscape; AlienVault OTX (hiroki),high,Observed scanning & exploitation infrastructure across 216 hosts; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=UA ASN=AS7029 windstream communications llc
94.154.43.149,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
94.154.43.185,ip,2026-10-21,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://fortiguard.fortinet.com/outbreak-alert/php2shell,ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki); FortiGuard,high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=UA ASN=AS7029 windstream communications llc; Active PHP2Shell exploitation & scanning infrastructure
94.154.43.222,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
94.154.43.7,ip,2026-10-21,https://offseq.com/en/research/php2shell-first-48-hours/#s-10,OffSeq Research,high,OffSeq Mirage honeypot fleet observed initial 48-hour probes
95.216.5.90,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,FortiGuard; ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Active PHP2Shell exploitation & scanning infrastructure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=FI ASN=AS24940 hetzner online gmbh
95.217.164.124,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,FortiGuard; ThreatLandscape; CYFIRMA Research; AlienVault OTX (hiroki),high,Active PHP2Shell exploitation & scanning infrastructure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=FI ASN=AS24940 hetzner online gmbh
95.217.98.37,ip,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://socradar.io/free-tools/ioc-radar/reports/php2shell-critical-php-rce-4b3415825163; https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://otx.alienvault.com/pulse/6ada2405b53c58bd52d0dc31; https://otx.alienvault.com/pulse/6ad9cc6686bcea85910dbd49; https://otx.alienvault.com/pulse/6ad9b9e8858f671a3a732a14,FortiGuard; SOCRadar; Amazon Threat Intelligence; CYFIRMA Research; AlienVault OTX; AlienVault OTX (hiroki); AlienVault OTX (CyberHunter_NL); AlienVault OTX (aziel415); AlienVault OTX (shadowBriefer),high,Active PHP2Shell exploitation & scanning infrastructure; Threat radar PHP2Shell exploitation attempts; Amazon MadPot honeypot telemetry observed prior to public disclosure; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; AlienVault OTX community & threat pulse telemetry; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - CC=DE ASN=AS24940 hetzner online gmbh; Hackers Were Targeting Critical PHP Vulnerabilities Days Before They Were Patched; Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed - CC=DE ASN=AS24940 hetzner online gmbh; [ShadowBrieferFeed] PHP2Shell Exploitation — CVE-2026-109618 & CVE-2026-109619 | AWS Threat Intelligence - CC=DE ASN=AS24940 hetzner online gmbh
035d396b3a329f59d680dc36a0a639eb7fb306bea97e42f5f53293dce817e8b7,sha256,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486,sha256,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6adeba5850017607f619cb5c; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://otx.alienvault.com/pulse/6adb676f5630ec8df6eb7117; https://otx.alienvault.com/pulse/6adb5b91d84b3856a2d47615; https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6adb23532c6b919b727c347d; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,FortiGuard; Arctic Wolf Labs; ThreatLandscape; CYFIRMA Research; Sophos CTU; AlienVault OTX (AlienVault); AlienVault OTX (celestre); AlienVault OTX (hiroki); AlienVault OTX (CyberHunter_NL); AlienVault OTX (projectargus),high,"Active PHP2Shell exploitation & scanning infrastructure; Observed PHP2Shell exploitation attempts & dropper hashes; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Potassium Mirai botnet exploitation & C2 infrastructure; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; IOC - Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) - SHA256 of c472dab4ff7c16782a8037f988d4daa6d4bdb343; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA - is__elf; Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware; Critical PHP Vulnerabilities Exploited Before Public Disclosure; PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Prompt Global Website Shutdowns; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks"
1485e14e0f62bc94664eec341cabd275dad7d30b1d496c40ec340c9a0d9f0ba8,sha256,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.vulncheck.com/blog/php2shell-vulnerabilities#indicators-of-compromise; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6ad91a624dfadf973556516c,FortiGuard; VulnCheck; AlienVault OTX; AlienVault OTX (AlienVault),high,Active PHP2Shell exploitation & scanning infrastructure; VulnCheck intelligence on PHP2Shell exploitation & payload hashes; AlienVault OTX community & threat pulse telemetry; PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619
150ae88f0999032e2a6113501d6082f54a3ed98d02427b21a96e773a27d7bf16,sha256,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.vulncheck.com/blog/php2shell-vulnerabilities#indicators-of-compromise; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6ad91a624dfadf973556516c,FortiGuard; VulnCheck; AlienVault OTX; AlienVault OTX (AlienVault),high,Active PHP2Shell exploitation & scanning infrastructure; VulnCheck intelligence on PHP2Shell exploitation & payload hashes; AlienVault OTX community & threat pulse telemetry; PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619
17758cf05e3376f8448dff926564e038b763b4a46668455e2ccb5ac0839e629c,sha256,2026-10-22,https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,AlienVault OTX (projectargus),high,PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks
24a293a662600b2292d9259baebba1c09b41df82a5c9c20f8572625ae759696f,sha256,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
267a3c8ed021a0a52c29bf076617a0dfd5cd5285202b8d0bd9ad0712110ccae8,sha256,2026-10-23,https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6adb23532c6b919b727c347d,AlienVault OTX (projectargus),high,PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Prompt Global Website Shutdowns
27d926a6708d6769d97d065e7a5a860ab496eab272c03d1cebc55ec71b954fa2,sha256,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.vulncheck.com/blog/php2shell-vulnerabilities#indicators-of-compromise; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6ad91a624dfadf973556516c,FortiGuard; VulnCheck; AlienVault OTX; AlienVault OTX (AlienVault),high,Active PHP2Shell exploitation & scanning infrastructure; VulnCheck intelligence on PHP2Shell exploitation & payload hashes; AlienVault OTX community & threat pulse telemetry; PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619
408b7fc4f08f2a9044046025f05995e8cbd5c96c39844aaa8a7eb8ee4697ea89,sha256,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
40caf199ca1ebe056a74427f8e9db06c66899e33ae09c0ec2769ec70bf6dd8e7,sha256,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://www.vulncheck.com/blog/php2shell-vulnerabilities#indicators-of-compromise; https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22; https://otx.alienvault.com/pulse/6ad91a624dfadf973556516c,FortiGuard; VulnCheck; AlienVault OTX; AlienVault OTX (AlienVault),high,Active PHP2Shell exploitation & scanning infrastructure; VulnCheck intelligence on PHP2Shell exploitation & payload hashes; AlienVault OTX community & threat pulse telemetry; PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619
42527a4388ef4ade6f4eaf52706f0ab31cb4e9ced3a56a6b15402551f9f01208,sha256,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a,sha256,2026-10-22,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,ThreatLandscape; CYFIRMA Research; AlienVault OTX (AlienVault); AlienVault OTX (hiroki); AlienVault OTX (projectargus),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA; PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks
4d02f14d109458cb0d696b65456918fcd724ca385aa30c688f08554c8899938c,sha256,2026-10-23,https://otx.alienvault.com/pulse/6adb5b91d84b3856a2d47615,AlienVault OTX (projectargus),high,Critical PHP Vulnerabilities Exploited Before Public Disclosure
590942bc868e9ee89884bb183de4b4c49dbf96d51578a4936d1fa88f422d3b1f,sha256,2026-10-24,https://otx.alienvault.com/pulse/6adc2dfd88487dcfec511cbc,AlienVault OTX (CyberHunterAutoFeed),high,Twitter Feed - hiropooh - 23-10-2026
7133612558a5d0f257ca6bdb4f765453af9465bc5298acdcf33b5761b8c59aac,sha256,2026-10-22,https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,AlienVault OTX (projectargus),high,PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks
7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6,sha256,2026-10-23,https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://otx.alienvault.com/pulse/6adc07f41102c5c37a64cd50; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210,ThreatLandscape; CYFIRMA Research; AlienVault OTX (AlienVault); AlienVault OTX (hiroki); AlienVault OTX (projectargus),high,Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA; PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches
7fc50b69b56bfdfa9fc0a3e088ff13904587d6336a51e9edcc7919cba83d4e3f,sha256,2026-10-22,https://otx.alienvault.com/pulse/6ada5c7f38bdc3333e62e3ef,AlienVault OTX (CyberHunter_NL),high,I had plans for that second
87a047160eb1a9b92e6ede511252dfc624b0f5a7185ac2cec1c7ebde8cdf4eea,sha256,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
891cc3ca2d29e9b185a8913e93810f48859d2be1f23ddd977a15cdbeed509e0e,sha256,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
917fcc9131c6e9ca16264a85afc62532297bb39eb9d37765dad536c7c8c7735c,sha256,2026-10-24,https://otx.alienvault.com/pulse/6adc2e119e6d0bfd200334c6,AlienVault OTX (CyberHunterAutoFeed),high,Twitter Feed - Huntbackio - 23-10-2026
985c3972712218c62d2418b41056dba5fe883ca5104d8ec12041f8611db344f9,sha256,2026-10-22,https://otx.alienvault.com/pulse/6ada5c7f38bdc3333e62e3ef,AlienVault OTX (CyberHunter_NL),high,I had plans for that second
9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507,sha256,2026-10-22,https://otx.alienvault.com/pulse/6ada5c7f38bdc3333e62e3ef,AlienVault OTX (CyberHunter_NL),high,I had plans for that second
9f833318d77051830252b4f3838e5b4bd81e13b6d7ec738f636198cc8ad73804,sha256,2026-10-24,https://threatfox.abuse.ch/ioc/142866/,abuse.ch ThreatFox / cert_bund,high,"Malware: Mirai | Threat: Malware payload sample hash | Tags: [Mirai, Potassium, PHP2Shell]"
a28f4a1329c0d381c85387d8534149021eb48a602167d3c01c0b115456f9175a,sha256,2026-10-24,https://threatfox.abuse.ch/ioc/142867/,abuse.ch ThreatFox / abuse_ch,high,"Malware: XMRig | Threat: Malware payload sample hash | Tags: [XMRig, PHP2Shell]"
b8419a676a3d4af04ea98287a2b85052fae5c06e6278ca9d8bfa4b5b396b39a6,sha256,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
bc9e2dac08fb4f83dddb44f89bf7082bb4134697fbf6a99ad8ce30c634e9fe8a,sha256,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
d8b52fbf3e5893a9efb8ef050db02e77b67da4226d96a75ce2361622359f939e,sha256,2026-10-25,https://threatfox.abuse.ch/ioc/142868/,abuse.ch ThreatFox / abuse_ch,high,"Malware: Potassium | Threat: Malware payload sample hash | Tags: [Potassium, PHP2Shell]"
d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1,sha256,2026-10-22,https://otx.alienvault.com/pulse/6ada5c7f38bdc3333e62e3ef,AlienVault OTX (CyberHunter_NL),high,I had plans for that second
dd98bf48899aa385035352688357742c73ddc5e47ec4ecc7d7b74c53c2e3ca3d,sha256,2026-10-22,https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6ada0a57479ee684d61bb657,AlienVault OTX (projectargus),high,PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Enable Remote Code Execution Attacks
e2529d4afa39ae4db2eb05d5176317c906289abf09660c75bdeec43e54c55aa3,sha256,2026-10-23,https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/; https://otx.alienvault.com/pulse/6adb5b8a2a3830a43348e210; https://otx.alienvault.com/pulse/6adb23532c6b919b727c347d,Arctic Wolf Labs; AlienVault OTX (projectargus),high,Observed PHP2Shell exploitation attempts & dropper hashes; PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches; Critical PHP Vulnerabilities Prompt Global Website Shutdowns
http://102.134.35.141:8080,url,2026-10-24,https://otx.alienvault.com/pulse/6adc2e1777bc4df2f0f7be51,AlienVault OTX (CyberHunterAutoFeed),high,Twitter Feed - Vega_Threat - 23-10-2026
http://102.134.35.141:9443,url,2026-10-24,https://otx.alienvault.com/pulse/6adc2e1777bc4df2f0f7be51,AlienVault OTX (CyberHunterAutoFeed),high,Twitter Feed - Vega_Threat - 23-10-2026
http://167.148.201.106:725/fakeurl.htm,url,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
http://217.60.102.5,url,2026-10-24,https://otx.alienvault.com/pulse/6adc2e119e6d0bfd200334c6,AlienVault OTX (CyberHunterAutoFeed),high,Twitter Feed - Huntbackio - 23-10-2026
http://217.60.102.5/sh,url,2026-10-24,https://otx.alienvault.com/pulse/6adc2e119e6d0bfd200334c6,AlienVault OTX (CyberHunterAutoFeed),high,Twitter Feed - Huntbackio - 23-10-2026
http://217.60.242.76,url,2026-10-24,https://otx.alienvault.com/pulse/6adc2e119e6d0bfd200334c6,AlienVault OTX (CyberHunterAutoFeed),high,Twitter Feed - Huntbackio - 23-10-2026
http://45.115.26.26:8000/cCmono,url,2026-10-23,https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/,Arctic Wolf Labs,high,Observed PHP2Shell exploitation attempts & dropper hashes
http://77.90.185.20,url,2026-10-24,https://otx.alienvault.com/pulse/6adc2e119e6d0bfd200334c6,AlienVault OTX (CyberHunterAutoFeed),high,Twitter Feed - Huntbackio - 23-10-2026
http://85.11.167.243,url,2026-10-24,https://otx.alienvault.com/pulse/6adc2e119e6d0bfd200334c6,AlienVault OTX (CyberHunterAutoFeed),high,Twitter Feed - Huntbackio - 23-10-2026
http://92.118.112.100/mountpoint,url,2026-10-23,https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/,Arctic Wolf Labs,high,Observed PHP2Shell exploitation attempts & dropper hashes
http://92.118.112.100/n,url,2026-10-21,https://otx.alienvault.com/browse/global/pulses?q=tag:%22php2shell%22,AlienVault OTX,high,AlienVault OTX community & threat pulse telemetry
http://92.118.112.100/nfs,url,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell; https://threatlandscape.io/blog/php2shell-campaign-cve-2026-109618-216-hosts#indicators-of-compromise; https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/; https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619; https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53; https://otx.alienvault.com/pulse/6adb676f5630ec8df6eb7117,FortiGuard; ThreatLandscape; CYFIRMA Research; Sophos CTU; AlienVault OTX (hiroki); AlienVault OTX (CyberHunter_NL),high,Active PHP2Shell exploitation & scanning infrastructure; Observed scanning & exploitation infrastructure across 216 hosts; Suspected DPRK campaign staging & scan infrastructure targeting PHP2Shell; Potassium Mirai botnet exploitation & C2 infrastructure; CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA; Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware
http://92.118.112.100/nfs-setup,url,2026-10-23,https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/,Arctic Wolf Labs,high,Observed PHP2Shell exploitation attempts & dropper hashes
http://92.118.112.100/nfs.,url,2026-10-25,https://otx.alienvault.com/pulse/6add9a0c4098fe8ecd33ad53,AlienVault OTX (hiroki),high,CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure - CYFIRMA
http://92.118.112.100/s,url,2026-10-21,https://fortiguard.fortinet.com/outbreak-alert/php2shell,FortiGuard,high,Active PHP2Shell exploitation & scanning infrastructure
http://ashevilleroofingcontractor.com/curl/bc9e2dac08fb4f83dddb44f89bf7082bb4134697fbf6a99ad8ce30c634e9fe8a,url,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
http://grillmasterchef.com/90e4a147-1234-505c-a024-062e543b5df8/timer6,url,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
http://orders-amazon-com.advancedfences.com/?gadsource=1&gadcampaignid=24300910299&gbraid=0AAAAAB5-hUQ67k8UWBU5316Kpe0DHQvLm&gclid=Cj0KCQjw5vLVBhCiARIsAD56SFKcNIrijpItFZHromjAHhVv8sQjArpaK4rTubr7G3kENmeATgbev2QaAs7pEALw_wcB,url,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
https://grillmasterchef.com/90e4a147-1234-505c-a024-062e543b5df8/v6,url,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
https://kiriosyka.com/KsxmmKiN5N0j/sqr-viewertr6,url,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure
https://liokida.com/KsxmmKiN5N0j/sqr-viewertr6z,url,2026-10-22,https://radar.offseq.com/threat/php2shell-mass-exploitation-looms-for-leaked-critical-php-flaws-47d22162f363ef2c,OffSeq Radar,high,OffSeq Threat Radar observed active exploitation infrastructure