Since the 21st October 2026 two vulnerabilities dubbed PHP2SHELL have dominated the news (cyber) for the last week, on the 21st it was revealed there was a pre-release leak and a pre-patch warning was issued. On the 21st a patch was released alongside a lot of activity in the media and social media.

I’m going to try and provide a bit of an update on where this is (remember, no one has a total view of the world, and as time goes on more intel/better intel will appear)

Timeline (Generated)

We can see here it’s messy! August is the discovery, there’s traffic in October, there’s the embargo leak and then an early patch release.

Within hours a POC is in GitHub and that is muttered into a working RCE against a specific PHP build for both AMD and x64 by the weekend.

There’s a part here missing, there were some Palo Alto firewalls compromised, one of which is apparently a USA government asset (more on that later)

Greynoise Honeypot Activity

In the Greynoise honeypots we have confirmed exploitation and then we have post initial access activity:

We can see here this threat actor was using MULVAD VPN at the time the packets were sent.

Honeypot Intrusion Timeline

• Oct 28 – automated scanning (2.59.133.151) – (that’s 7 days after patch)
• Oct 29 – hands-on compromise (185.65.134.250): RCE > reverse shell to 206.245.153.56:42104, SSH key persistence, linpeas/gitleaks, cloud IMDS theft, exfil – +8 days after patch, +3 after KEV
• Oct 30 02:24 – re-entry via the implanted key

Activity

We can see here LINPEAS was used, we can also see the packets were sent the following day. This looks automated (the chain looks scripted as well)

General Sensor Net

We can see from sensor data as well activity over the last week, please note this activity != confirmed exploitation at that time. A real challenge here is attempt != successful action on the targets. Which makes tracking this more complex.

and a more zoomed in view:

Observations

This looks like someone scanning (spaying) to find vulnerable systems and then spraying in an automated fashion exploitation attempts, followed by an automated compromise routine.

It has linpeaas in it, which is highly signatured, the filename isn’t even obfuscated.

I’m going to take a stab and say: I think this was vibe coded / LLM generated.

Now I would say: why would someone not have EDR on the internet facing servers running a vulnerable version of PHP but then, reality would say, what can be done != what is commonly done.

I think this is where we struggle, in a real scenario there’s a few thing:

1. would the php exploit payload be keyed correctly for the target?
2. what does the targets security posture look like?
3. Would AV or EDR have blocked this? (honestly, most linux servers don’t have AV or EDR)

Threat

I think, it’s been a week, we are seeing more activity with PHP2SHELL but we probably need to wait longer. As I said at the start, there’s also a TA who has compromised some Palo Alto firewalls with this vulnerability, so I’ll write about that soon, I’m fairly sure I may comment on the ‘why have they exposed the management interface to the internet’ for that one!

Actions to take

The call to patch internet facing assets (at minimum) was 7 days ago, with a global level of coverage which could be described as ‘very high’. I litterally live pathed this server via twitter and posted a blog just before the update process (I used a backport patch method), so…. what does this new intel say to us:

• If you haven’t patched by now, why are you waiting?
• put in place additional controls such as WAF, AV, EDR, Hardening, Segmentation. etc.
• Deploy honeypots/canaries etc.
• If you are a security team, continue to monitor both your own systems and the threat intel landscape

Summary

As with all critical vulnerabilities where unauthenticated RCE is part of the chain, there’s always going to be some exploitation, to date we haven’t seen the world end, we have however seen limited activity in honeypots and a single real world incident cluster (~20-25 Palo Altos may have been compromised, at least 1 has been confirmed)

Sources

Greynoise have a post here with loads of details (thanks team greynoise!)
https://php.events.greynoise.io