PHP2Shell field report — the attacker-side view.
The first exploit-shaped request hit our Mirage honeypot fleet at 21:57 UTC on 20 Oct, ~16h before the patch embargo lifted. Over the next 48h: 9 source IPs, 7 countries, 2 distinct attack shapes.
Highlights:
One actor swept body size <1KB → 16KB+, 200+ unique payloads in 2 min — live calibration of the OOM trigger
The lead tool stamps ----p2shell<hex> into its multipart boundary: a zero-false-positive detection tell we haven’t seen documented elsewhere
A B8RAT/1.0 actor reaching for the deserialization path (CVE-2026-109619) while others hammer the OOM path (CVE-2026-109618)
Independent confirmation of the pre-disclosure exploitation Amazon & Cloudflare reported, from a second sensor network
Full writeup + IOCs:
https://offseq.com/en/research/php2shell-first-48-hours/
OffSeqPHP2Shell in the wild: the first 48 hours on a honeypot fleet – OffSeqPHP2Shell leaked before its patch, and the first exploit-shaped request hit OffSeq's Mirage fleet about sixteen hours before the fix shipped.