# Generated review pack. Map placeholders and tune each log source before conversion.
# Independent Sigma detections separated by YAML document boundaries; not one Boolean rule.
title: "PHP2Shell - Unknown on line 0"
id: 0187f040-bacd-4d56-b569-fc30a37e21d2
name: php2shell_catalog_memory_unknown
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: Detects memory exhaustion · unknown source; does not establish a web shell.
date: 2026-10-22
logsource:
  category: application
  product: php
detection:
  selection:
    "[MESSAGE_FIELD]|re": '(?i)\bAllowed[ \t]+memory[ \t]+size[ \t]+of[ \t]+[0-9]+[ \t]+bytes[ \t]+exhausted\b(?:[ \t]+at[ \t]+[^ \t\r\n]+)?(?:[ \t]+\([^\r\n()]{0,240}\))?[ \t]+in[ \t]+Unknown[ \t]+on[ \t]+line[ \t]+0\b'
  condition: selection
falsepositives:
  - Application defects or legitimate memory-intensive workloads
  - Misconfigured memory limits
level: low
references:
    - "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
    - "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
    - "https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/"
x_sec: {"catalog_id":"memory-unknown","group":"Memory errors","cve_context":"CVE-2026-109618 · OOM opportunity; may inform 109619 correlation","optional_hunt":false,"verification":"Unconfirmed","notes":"Map this PHP application logsource and [MESSAGE_FIELD] in your converter. The re modifier requires regex-capable backend conversion; verify case handling and escaping in the generated query. Correlation is configured separately.","provenance":"Unconfirmed interpretation. Links provide related context. Supplied log signature; PHP advisories support the startup/OOM and stale-state context. The exact error is not CVE-exclusive. Additional references reviewed 25 October 2026 support the signal or mechanism; local thresholds, matching details and CVE attribution retain their stated limitations.","references":[{"label":"PHP advisory: CVE-2026-109618","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"},{"label":"PHP advisory: CVE-2026-109619","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"},{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"},{"label":"CrowdStrike PHP2Shell memory-error detection","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - All memory exhaustion"
id: 71d61055-c38f-4e28-b1c0-7eed95e802c9
name: php2shell_catalog_memory_base
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: Detects memory exhaustion · any source; does not establish a web shell.
date: 2026-10-22
logsource:
  category: application
  product: php
detection:
  selection:
    "[MESSAGE_FIELD]|re": '(?i)\bAllowed[ \t]+memory[ \t]+size[ \t]+of[ \t]+[0-9]+[ \t]+bytes[ \t]+exhausted\b'
  condition: selection
falsepositives:
  - Application defects or legitimate memory-intensive workloads
  - Misconfigured memory limits
level: low
x_sec: {"catalog_id":"memory-base","group":"Memory errors","cve_context":null,"optional_hunt":false,"verification":null,"notes":"Map this PHP application logsource and [MESSAGE_FIELD] in your converter. The re modifier requires regex-capable backend conversion; verify case handling and escaping in the generated query. Correlation is configured separately.","provenance":null,"references":[],"members":[],"aliases":[]}
---
title: "PHP2Shell - Unknown line 0 · HTML or plaintext"
id: dd115b5a-449e-4537-99d1-8333f71ea3d5
name: php2shell_catalog_memory_html
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: Detects memory exhaustion · unknown line 0, html or plaintext; does not establish a web shell.
date: 2026-10-22
logsource:
  category: application
  product: php
detection:
  selection:
    "[MESSAGE_FIELD]|re": '(?i)\bAllowed[ \t]+memory[ \t]+size[ \t]+of[ \t]+[0-9]+[ \t]+bytes[ \t]+exhausted\b(?:[ \t]+at[ \t]+[^ \t\r\n]+)?(?:[ \t]+\([^\r\n()]{0,240}\))?[ \t]+in[ \t]+(?:Unknown|<b>Unknown</b>)[ \t]+on[ \t]+line[ \t]+(?:0\b|<b>0</b>)'
  condition: selection
falsepositives:
  - Application defects or legitimate memory-intensive workloads
  - Misconfigured memory limits
level: low
references:
    - "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
    - "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
    - "https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/"
x_sec: {"catalog_id":"memory-html","group":"Memory errors","cve_context":"CVE-2026-109618 · OOM opportunity; may inform 109619 correlation","optional_hunt":false,"verification":"Unconfirmed","notes":"Map this PHP application logsource and [MESSAGE_FIELD] in your converter. The re modifier requires regex-capable backend conversion; verify case handling and escaping in the generated query. Correlation is configured separately.","provenance":"Unconfirmed interpretation. Links provide related context. Supplied log signature; PHP advisories support the startup/OOM and stale-state context. The exact error is not CVE-exclusive. Additional references reviewed 25 October 2026 support the signal or mechanism; local thresholds, matching details and CVE attribution retain their stated limitations.","references":[{"label":"PHP advisory: CVE-2026-109618","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"},{"label":"PHP advisory: CVE-2026-109619","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"},{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"},{"label":"CrowdStrike PHP2Shell memory-error detection","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Source IPs (254)"
id: 1e1f7c16-a320-5d32-9027-616fb633a1aa
name: php2shell_catalog_source_ips
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find requests from reported source IPs across the referenced datasets."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[SOURCE_IP_FIELD]|cased":
      - "2.59.133.151"
      - "3.68.250.21"
      - "5.34.220.134"
      - "5.104.86.24"
      - "5.112.76.18"
      - "5.161.255.209"
      - "5.175.189.76"
      - "5.181.181.168"
      - "5.189.160.29"
      - "5.189.184.114"
      - "5.231.118.119"
      - "5.255.114.109"
      - "13.201.109.35"
      - "13.216.152.122"
      - "14.120.124.27"
      - "18.234.199.237"
      - "18.237.26.182"
      - "20.24.237.207"
      - "20.87.120.146"
      - "20.200.234.181"
      - "20.204.147.74"
      - "20.238.86.17"
      - "23.26.237.221"
      - "23.100.50.44"
      - "23.106.131.214"
      - "23.165.56.186"
      - "23.234.113.169"
      - "23.234.117.66"
      - "23.238.31.189"
      - "27.34.69.235"
      - "27.100.38.10"
      - "31.133.50.90"
      - "31.182.51.55"
      - "31.223.184.166"
      - "34.19.34.88"
      - "34.76.218.47"
      - "34.76.232.95"
      - "34.136.122.211"
      - "34.222.146.226"
      - "35.154.84.153"
      - "36.162.178.158"
      - "37.19.198.236"
      - "37.19.200.5"
      - "37.27.209.157"
      - "38.60.206.217"
      - "38.180.45.91"
      - "38.180.230.11"
      - "38.180.230.216"
      - "43.134.82.85"
      - "43.173.9.190"
      - "45.61.178.105"
      - "45.78.14.116"
      - "45.115.26.26"
      - "45.130.200.101"
      - "45.136.71.89"
      - "45.141.233.9"
      - "45.148.10.80"
      - "45.148.10.201"
      - "45.156.87.44"
      - "45.156.129.57"
      - "45.198.224.169"
      - "46.7.145.54"
      - "46.37.123.14"
      - "46.101.229.142"
      - "46.166.168.18"
      - "46.205.208.16"
      - "47.250.155.133"
      - "51.83.187.123"
      - "51.143.62.244"
      - "52.17.252.187"
      - "52.53.131.214"
      - "52.53.211.104"
      - "52.172.142.28"
      - "52.250.54.233"
      - "54.149.222.88"
      - "54.154.150.2"
      - "57.129.80.197"
      - "63.186.150.111"
      - "64.111.92.102"
      - "64.227.149.251"
      - "66.116.196.142"
      - "67.205.129.138"
      - "72.251.215.19"
      - "74.208.16.253"
      - "74.208.79.255"
      - "74.208.167.97"
      - "74.208.242.33"
      - "75.119.143.189"
      - "77.90.185.20"
      - "77.91.113.125"
      - "77.239.124.121"
      - "77.243.184.207"
      - "78.47.85.99"
      - "79.110.49.21"
      - "79.193.197.168"
      - "80.66.66.66"
      - "81.28.4.17"
      - "82.221.101.119"
      - "83.21.173.138"
      - "83.147.13.219"
      - "85.11.167.243"
      - "85.11.190.112"
      - "85.199.255.137"
      - "87.192.237.19"
      - "88.216.36.31"
      - "89.37.63.57"
      - "89.37.63.146"
      - "89.37.63.204"
      - "89.37.63.248"
      - "89.125.59.156"
      - "90.155.6.87"
      - "91.90.123.25"
      - "92.51.2.85"
      - "92.88.170.153"
      - "94.130.216.171"
      - "94.154.43.7"
      - "94.154.43.100"
      - "94.154.43.149"
      - "94.154.43.185"
      - "94.154.43.187"
      - "94.154.43.189"
      - "94.154.43.222"
      - "95.139.123.158"
      - "95.216.5.90"
      - "95.217.98.37"
      - "95.217.164.124"
      - "98.80.11.91"
      - "98.98.47.154"
      - "101.36.114.102"
      - "101.128.110.145"
      - "102.207.250.188"
      - "102.210.149.166"
      - "103.114.163.188"
      - "103.131.131.168"
      - "103.149.183.197"
      - "103.151.172.95"
      - "103.204.193.27"
      - "103.216.220.92"
      - "104.28.221.228"
      - "104.28.233.170"
      - "104.243.29.169"
      - "105.156.180.134"
      - "109.71.252.97"
      - "109.120.147.103"
      - "112.66.197.171"
      - "112.66.198.12"
      - "114.26.103.72"
      - "116.251.216.106"
      - "116.251.216.117"
      - "119.59.101.74"
      - "120.235.218.21"
      - "121.127.33.74"
      - "123.25.115.82"
      - "129.153.133.23"
      - "130.12.180.42"
      - "134.209.159.64"
      - "134.209.252.157"
      - "138.199.43.94"
      - "141.94.33.148"
      - "141.98.255.191"
      - "141.98.255.246"
      - "143.246.213.138"
      - "144.31.90.126"
      - "144.48.4.242"
      - "145.239.91.0"
      - "146.70.98.138"
      - "146.70.117.243"
      - "146.70.131.237"
      - "146.70.184.216"
      - "146.70.201.232"
      - "146.70.217.86"
      - "146.70.224.226"
      - "147.78.241.219"
      - "147.182.222.30"
      - "149.28.157.90"
      - "149.102.229.156"
      - "150.241.121.67"
      - "151.241.171.87"
      - "152.42.195.115"
      - "152.53.193.96"
      - "153.75.83.37"
      - "154.26.182.240"
      - "156.146.38.170"
      - "156.225.28.97"
      - "157.245.110.32"
      - "159.26.109.92"
      - "159.26.110.122"
      - "159.26.110.129"
      - "159.223.59.200"
      - "161.132.37.162"
      - "161.184.215.40"
      - "166.1.90.109"
      - "167.17.47.102"
      - "167.233.52.2"
      - "168.63.74.28"
      - "169.150.227.213"
      - "170.62.100.187"
      - "170.62.100.237"
      - "170.187.190.236"
      - "170.205.31.28"
      - "172.166.165.148"
      - "175.117.45.36"
      - "176.4.191.221"
      - "176.65.132.128"
      - "176.65.139.168"
      - "176.124.32.170"
      - "178.104.167.156"
      - "178.249.209.166"
      - "178.249.214.6"
      - "182.2.177.82"
      - "182.2.182.165"
      - "182.2.190.142"
      - "183.241.192.249"
      - "184.73.151.236"
      - "185.65.134.250"
      - "185.65.135.250"
      - "185.130.45.226"
      - "185.131.54.148"
      - "185.177.72.45"
      - "185.207.232.121"
      - "185.213.154.179"
      - "185.225.191.232"
      - "185.252.220.147"
      - "186.22.19.172"
      - "188.166.166.205"
      - "191.217.250.227"
      - "192.9.168.47"
      - "192.42.116.100"
      - "192.140.154.1"
      - "192.169.119.217"
      - "192.253.209.123"
      - "193.29.106.28"
      - "193.32.249.238"
      - "193.47.62.24"
      - "194.42.196.44"
      - "194.156.238.177"
      - "195.88.87.101"
      - "198.44.159.163"
      - "198.200.59.85"
      - "200.119.44.50"
      - "200.141.3.58"
      - "203.189.139.225"
      - "204.76.203.237"
      - "206.71.169.144"
      - "212.30.206.158"
      - "212.95.52.99"
      - "217.60.196.124"
      - "217.60.242.58"
      - "217.60.242.76"
      - "220.158.233.62"
      - "221.14.159.134"
      - "223.178.86.187"
      - "223.181.62.146"
      - "223.252.16.151"
  condition: selection_1
falsepositives:
  - "Investigate matches; shared infrastructure and address reassignment limit attribution. References and verification apply to each source observation, not automatically to every address in the set. The supplied 21–22 October Previdian observations remain Unconfirmed; later research retains separate evidence. Map trusted client IPs through your proxy chain."
level: low
references:
    - "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/"
    - "https://www.vulncheck.com/blog/php2shell-vulnerabilities"
    - "https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"
    - "https://offseq.com/en/research/php2shell-first-48-hours/"
    - "https://www.greynoise.io/"
    - "https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv"
    - "https://php.events.greynoise.io/"
    - "https://previdian.com/"
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
    - "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
    - "https://blog.previdian.com/php2shell-activity-across-previdian-network/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"source-ips","group":"IP lists","cve_context":"CVE-2026-109618 / CVE-2026-109619 · campaign context","optional_hunt":false,"verification":"Mixed — see per-source evidence","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Investigate matches; shared infrastructure and address reassignment limit attribution. References and verification apply to each source observation, not automatically to every address in the set. The supplied 21–22 October Previdian observations remain Unconfirmed; later research retains separate evidence. Map trusted client IPs through your proxy chain.","provenance":"Deduplicated by address and traffic role. Each address retains its original source observations, dates, verification and limitations.","references":[{"label":"AWS MadPot report","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/"},{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities"},{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"},{"label":"OffSeq — first 48 hours","url":"https://offseq.com/en/research/php2shell-first-48-hours/"},{"label":"GreyNoise","url":"https://www.greynoise.io/"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/"},{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json"},{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"},{"label":"Arctic Wolf PHP2Shell observations","url":"https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"},{"label":"Previdian Research — PHP2Shell Activity Across Previdian Network, 28 October 2026","url":"https://blog.previdian.com/php2shell-activity-across-previdian-network/"}],"members":[{"indicator":"2.59.133.151","sourceKeys":["greynoise","greynoiseEvents","previdianResearch"],"aliases":["greynoise-event-2-59-133-151","previdian-20261028-source"],"evidence":[{"id":"greynoise-event-2-59-133-151","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"dataforest GmbH","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. GreyNoise confirmed six shell executions from this source, 28–29 October 2026 (apache2 → sh running curl to its own address on TCP 7 or 4, then sleep 5). Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion. dataforest GmbH, AS58212, Germany. GreyNoise first_seen 2026-04-11; last seen 2026-10-30 02:32:02 UTC; 47 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a source GreyNoise confirmed executing commands on a vulnerable sensor.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]},{"id":"previdian-20261028-source","sourceKeys":["previdianResearch"],"verification":"Referenced","date":"2026-10-28","checked":"2026-10-29","provenance":"Previdian Research, 28 October 2026, reports Apache shell execution on four honeypots. Local predicates and correlations are adaptations; command execution was observed but script retrieval and sleep execution were not.","context":"Find inbound requests from the source reported in Previdian’s confirmed execution sequence.","limit":"Source observation only; address reassignment and unrelated traffic limit attribution.","references":[{"label":"Previdian Research — PHP2Shell Activity Across Previdian Network, 28 October 2026","url":"https://blog.previdian.com/php2shell-activity-across-previdian-network/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"3.68.250.21","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-3-68-250-21"],"evidence":[{"id":"greynoise-event-3-68-250-21","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Amazon.com, Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Amazon.com, Inc., AS16509, Germany. GreyNoise first_seen 2026-10-22; last seen 2026-10-22 04:37:58 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"5.34.220.134","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-5-34-220-134"],"evidence":[{"id":"greynoise-event-5-34-220-134","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"Akari Networks","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Akari Networks, AS38136, Japan. GreyNoise first_seen 2021-11-10; last seen 2026-10-28 13:50:01 UTC; 58 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"5.104.86.24","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-5-104-86-24"],"evidence":[{"id":"greynoise-event-5-104-86-24","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"Contabo Asia Private Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. Contabo Asia Private Limited, AS141995, Japan. GreyNoise first_seen 2025-07-15; last seen 2026-10-29 15:55:06 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"5.112.76.18","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-5-112-76-18"],"evidence":[{"id":"greynoise-event-5-112-76-18","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"Iran Cell Service and Communication Company","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Iran Cell Service and Communication Company, AS44244, Iran. GreyNoise first_seen 2021-09-16; last seen 2026-10-25 23:06:07 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"5.161.255.209","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-5-161-255-209"],"evidence":[{"id":"greynoise-event-5-161-255-209","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Hetzner Online GmbH","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Hetzner Online GmbH, AS213230, United States. GreyNoise first_seen 2026-10-21; last seen 2026-10-22 17:37:54 UTC; 212 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"5.175.189.76","sourceKeys":["cisa","cisaSigma","arcticWolf"],"aliases":["hunt-cisa-arctic-ip"],"evidence":[{"id":"hunt-cisa-arctic-ip","sourceKeys":["cisa","cisaSigma","arcticWolf"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"Arctic Wolf lists this IP without a role in its current IOC table. Classified as a source IP by the catalog owner’s instruction on 29 October 2026.","context":"Find requests from the Arctic Wolf reported IP, treated as a source under the catalog owner’s assumption.","limit":"The report’s indicator list does not establish this address’s traffic direction or role. The catalog owner assumes source role; this is a local classification, not independently confirmed attacker infrastructure.","references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"Arctic Wolf PHP2Shell observations","url":"https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"5.181.181.168","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-5-181-181-168"],"evidence":[{"id":"greynoise-event-5-181-181-168","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"Mynymbox Hosting LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit. Mynymbox Hosting LLC, AS211673, Finland. GreyNoise first_seen 2026-10-16; last seen 2026-10-28 21:57:27 UTC; 91 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"5.189.160.29","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-5-189-160-29"],"evidence":[{"id":"greynoise-event-5-189-160-29","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-21","organization":"Contabo GmbH","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Contabo GmbH, AS51167, France. GreyNoise first_seen 2026-10-20; last seen 2026-10-21 18:53:42 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"5.189.184.114","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-5-189-184-114"],"evidence":[{"id":"greynoise-event-5-189-184-114","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Contabo GmbH","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, Session Poisoning, php2shell-Labeled Tooling. Contabo GmbH, AS51167, France. GreyNoise first_seen 2026-10-21; last seen 2026-10-22 03:38:40 UTC; 30 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"5.231.118.119","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-5-231-118-119"],"evidence":[{"id":"greynoise-event-5-231-118-119","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Tom Gewiese","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Tom Gewiese, AS215365, Netherlands. GreyNoise first_seen 2026-10-22; last seen 2026-10-23 03:44:48 UTC; 3 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"5.255.114.109","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-5-255-114-109","greynoise-event-5-255-114-109"],"evidence":[{"id":"greynoise-source-5-255-114-109","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Liteserver","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":4,"latestAlert":"2026-10-24T09:01:54Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Liteserver. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 4; latest alert: 2026-10-24T09:01:54Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-5-255-114-109","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"Liteserver","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Liteserver, AS60404, Netherlands. GreyNoise first_seen 2026-09-09; last seen 2026-10-30 05:59:59 UTC; 5292 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"13.201.109.35","sourceKeys":["ellio","greynoise","greynoiseEvents"],"aliases":["ellio-source-13-201-109-35","greynoise-event-13-201-109-35"],"evidence":[{"id":"ellio-source-13-201-109-35","sourceKeys":["ellio"],"verification":"Referenced","date":"2026-10-21","checked":"2026-10-23","provenance":"ELLIO report figure: A day of PHP2Shell requests, address by address. Nine source addresses observed on 21 October 2026 (UTC).","context":"Find inbound requests from a source IP in ELLIO’s 21 October timeline.","limit":"The timeline includes probes and exploit-like requests; an IP match alone does not establish compromise.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]},{"id":"greynoise-event-13-201-109-35","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-24","organization":"Amazon.com, Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. Amazon.com, Inc., AS16509, India. GreyNoise first_seen 2026-09-09; last seen 2026-10-24 23:50:00 UTC; 35 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"13.216.152.122","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-13-216-152-122"],"evidence":[{"id":"greynoise-event-13-216-152-122","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Amazon.com, Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Session Poisoning. Amazon.com, Inc., AS14618, United States. GreyNoise first_seen 2026-10-22; last seen 2026-10-22 16:23:31 UTC; 31 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"14.120.124.27","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-14-120-124-27"],"evidence":[{"id":"greynoise-event-14-120-124-27","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"CHINANET BACKBONE","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. CHINANET BACKBONE, AS4134, China. GreyNoise first_seen 2026-10-28; last seen 2026-10-28 15:33:14 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"18.234.199.237","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-18-234-199-237"],"evidence":[{"id":"greynoise-event-18-234-199-237","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"Amazon.com, Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Amazon.com, Inc., AS14618, United States. GreyNoise first_seen 2026-10-22; last seen 2026-10-29 04:52:48 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"18.237.26.182","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-18-237-26-182"],"evidence":[{"id":"greynoise-source-18-237-26-182","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Amazon.com, Inc.","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":3,"latestAlert":"2026-10-21T14:01:05Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Amazon.com, Inc.. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 3; latest alert: 2026-10-21T14:01:05Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"20.24.237.207","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-20-24-237-207"],"evidence":[{"id":"greynoise-event-20-24-237-207","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Microsoft Corporation","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Microsoft Corporation, AS8075, Hong Kong. GreyNoise first_seen 2026-09-29; last seen 2026-10-22 03:03:28 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"20.87.120.146","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-20-87-120-146"],"evidence":[{"id":"greynoise-event-20-87-120-146","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Microsoft Corporation","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Microsoft Corporation, AS8075, South Africa. GreyNoise first_seen 2026-03-22; last seen 2026-10-23 21:00:05 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"20.200.234.181","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-20-200-234-181","greynoise-event-20-200-234-181"],"evidence":[{"id":"greynoise-source-20-200-234-181","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Microsoft Corporation","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:00:47Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Microsoft Corporation. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-22T09:00:47Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-20-200-234-181","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-27","organization":"Microsoft Corporation","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Microsoft Corporation, AS8075, South Korea. GreyNoise first_seen 2026-03-09; last seen 2026-10-27 18:36:28 UTC; 492 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"20.204.147.74","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-20-204-147-74"],"evidence":[{"id":"greynoise-event-20-204-147-74","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-27","organization":"Microsoft Corporation","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Request Memory Exhaustion, Session Poisoning, php2shell-Labeled Tooling. Microsoft Corporation, AS8075, India. GreyNoise first_seen 2026-07-02; last seen 2026-10-27 22:04:39 UTC; 70 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"20.238.86.17","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-20-238-86-17"],"evidence":[{"id":"greynoise-source-20-238-86-17","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Microsoft Corporation","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-21T14:01:05Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Microsoft Corporation. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-21T14:01:05Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"23.26.237.221","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-23-26-237-221"],"evidence":[{"id":"greynoise-event-23-26-237-221","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-27","organization":"Evoxt Sdn. Bhd.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Evoxt Sdn. Bhd., AS149440, Netherlands. GreyNoise first_seen 2026-08-28; last seen 2026-10-27 18:34:43 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"23.100.50.44","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-23-100-50-44"],"evidence":[{"id":"greynoise-source-23-100-50-44","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Microsoft Corporation","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-21T14:01:05Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Microsoft Corporation. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-21T14:01:05Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"23.106.131.214","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-23-106-131-214","greynoise-event-23-106-131-214"],"evidence":[{"id":"greynoise-source-23-106-131-214","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"IT7 Networks Inc","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-24T09:00:49Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: IT7 Networks Inc. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-24T09:00:49Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-23-106-131-214","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-24","organization":"IT7 Networks Inc","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. IT7 Networks Inc, AS25820, Japan. GreyNoise first_seen 2022-03-02; last seen 2026-10-24 12:56:04 UTC; 58 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"23.165.56.186","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-23-165-56-186"],"evidence":[{"id":"greynoise-event-23-165-56-186","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"Infocrest Systems LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Infocrest Systems LLC, AS397668, United States. GreyNoise first_seen 2026-10-09; last seen 2026-10-29 04:46:47 UTC; 16 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"23.234.113.169","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-23-234-113-169"],"evidence":[{"id":"greynoise-event-23-234-113-169","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"tzulo, inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. tzulo, inc., AS11878, United States. GreyNoise first_seen 2025-07-09; last seen 2026-10-30 03:07:45 UTC; 15 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"23.234.117.66","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-23-234-117-66"],"evidence":[{"id":"greynoise-event-23-234-117-66","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"tzulo, inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. tzulo, inc., AS11878, United States. GreyNoise first_seen 2025-07-13; last seen 2026-10-29 13:14:18 UTC; 17 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"23.238.31.189","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-23-238-31-189"],"evidence":[{"id":"greynoise-event-23-238-31-189","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-27","organization":"HostPapa","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. HostPapa, AS36352, United States. GreyNoise first_seen 2026-07-23; last seen 2026-10-27 02:55:39 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"27.34.69.235","sourceKeys":["previdian"],"aliases":["private-source-27-34-69-235"],"evidence":[{"id":"private-source-27-34-69-235","sourceKeys":["previdian"],"verification":"Unconfirmed","date":"2026-10-21","checked":"2026-10-23","firstSeen":"2026-10-21T19:59:13Z","lastSeen":"2026-10-21T19:59:13Z","observations":1,"provenance":"Supplied CVE-2026-109618-observations.json; Previdian. Not independently corroborated.","context":"Find requests from a source IP in the supplied Previdian observations.","limit":"Investigation lead, not a blocking recommendation.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json","role":"Related context only"}]}],"verification":"Unconfirmed"},{"indicator":"27.100.38.10","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-27-100-38-10"],"evidence":[{"id":"greynoise-event-27-100-38-10","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"Tier 4 Cloud Services","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Tier 4 Cloud Services, AS146943, India. GreyNoise first_seen 2026-10-23; last seen 2026-10-30 05:23:07 UTC; 515 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"31.133.50.90","sourceKeys":["previdian"],"aliases":["private-source-31-133-50-90"],"evidence":[{"id":"private-source-31-133-50-90","sourceKeys":["previdian"],"verification":"Unconfirmed","date":"2026-10-21","checked":"2026-10-23","firstSeen":"2026-10-21T22:38:22Z","lastSeen":"2026-10-21T22:55:14Z","observations":2,"provenance":"Supplied CVE-2026-109618-observations.json; Previdian. Not independently corroborated.","context":"Find requests from a source IP in the supplied Previdian observations.","limit":"Investigation lead, not a blocking recommendation.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json","role":"Related context only"}]}],"verification":"Unconfirmed"},{"indicator":"31.182.51.55","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-31-182-51-55"],"evidence":[{"id":"greynoise-event-31-182-51-55","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Toya sp.z.o.o","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Toya sp.z.o.o, AS16342, Poland. GreyNoise first_seen 2026-10-21; last seen 2026-10-23 10:51:26 UTC; 1063 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"31.223.184.166","sourceKeys":["aws"],"aliases":["reported-2"],"evidence":[{"id":"reported-2","sourceKeys":["aws"],"verification":"Referenced","date":"2026-10-21","checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise.","context":"AWS MadPot exploitation-attempt source. Shared anonymization infrastructure; investigate rather than blanket-block.","limit":"Shared or reassigned addresses reduce attribution value.","references":[{"label":"AWS MadPot report","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"34.19.34.88","sourceKeys":["offseq"],"aliases":["offseq-source-34-19-34-88"],"evidence":[{"id":"offseq-source-34-19-34-88","sourceKeys":["offseq"],"verification":"Referenced","date":"2026-10-20 / 2026-10-22","checked":"2026-10-23","provenance":"OffSeq first-48-hours report: upload-progress requests, probes or memory-pressure bodies on low-interaction sensors; not demonstrated compromise.","context":"Find requests from OffSeq-reported probe and attempt sources. Some memory-pressure traffic was classified by request shape.","limit":"Investigation lead; shared infrastructure and fingerprints can overlap benign traffic.","references":[{"label":"OffSeq — first 48 hours","url":"https://offseq.com/en/research/php2shell-first-48-hours/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"34.76.218.47","sourceKeys":["offseq"],"aliases":["offseq-source-34-76-218-47"],"evidence":[{"id":"offseq-source-34-76-218-47","sourceKeys":["offseq"],"verification":"Referenced","date":"2026-10-20 / 2026-10-22","checked":"2026-10-23","provenance":"OffSeq first-48-hours report: upload-progress requests, probes or memory-pressure bodies on low-interaction sensors; not demonstrated compromise.","context":"Find requests from OffSeq-reported probe and attempt sources. Some memory-pressure traffic was classified by request shape.","limit":"Investigation lead; shared infrastructure and fingerprints can overlap benign traffic.","references":[{"label":"OffSeq — first 48 hours","url":"https://offseq.com/en/research/php2shell-first-48-hours/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"34.76.232.95","sourceKeys":["offseq"],"aliases":["offseq-source-34-76-232-95"],"evidence":[{"id":"offseq-source-34-76-232-95","sourceKeys":["offseq"],"verification":"Referenced","date":"2026-10-20 / 2026-10-22","checked":"2026-10-23","provenance":"OffSeq first-48-hours report: upload-progress requests, probes or memory-pressure bodies on low-interaction sensors; not demonstrated compromise.","context":"Find requests from OffSeq-reported probe and attempt sources. Some memory-pressure traffic was classified by request shape.","limit":"Investigation lead; shared infrastructure and fingerprints can overlap benign traffic.","references":[{"label":"OffSeq — first 48 hours","url":"https://offseq.com/en/research/php2shell-first-48-hours/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"34.136.122.211","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-34-136-122-211","greynoise-event-34-136-122-211"],"evidence":[{"id":"greynoise-source-34-136-122-211","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Google LLC","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:00:47Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Google LLC. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-22T09:00:47Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-34-136-122-211","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Google LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Google LLC, AS396982, United States. GreyNoise first_seen 2026-10-22; last seen 2026-10-22 07:42:20 UTC; 100 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"34.222.146.226","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-34-222-146-226"],"evidence":[{"id":"greynoise-source-34-222-146-226","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Amazon.com, Inc.","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":3,"latestAlert":"2026-10-21T14:01:05Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Amazon.com, Inc.. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 3; latest alert: 2026-10-21T14:01:05Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"35.154.84.153","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-35-154-84-153"],"evidence":[{"id":"greynoise-event-35-154-84-153","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"Amazon.com, Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Amazon.com, Inc., AS16509, India. GreyNoise first_seen 2026-03-09; last seen 2026-10-25 22:00:36 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"36.162.178.158","sourceKeys":["ellio"],"aliases":["ellio-source-36-162-178-158"],"evidence":[{"id":"ellio-source-36-162-178-158","sourceKeys":["ellio"],"verification":"Referenced","date":"2026-10-21","checked":"2026-10-23","provenance":"ELLIO report figure: A day of PHP2Shell requests, address by address. Nine source addresses observed on 21 October 2026 (UTC).","context":"Find inbound requests from a source IP in ELLIO’s 21 October timeline.","limit":"The timeline includes probes and exploit-like requests; an IP match alone does not establish compromise.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"37.19.198.236","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-37-19-198-236"],"evidence":[{"id":"greynoise-event-37-19-198-236","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"Datacamp Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Datacamp Limited, AS212238, United States. GreyNoise first_seen 2024-12-04; last seen 2026-10-25 09:56:53 UTC; 4 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"37.19.200.5","sourceKeys":["aws"],"aliases":["reported-3"],"evidence":[{"id":"reported-3","sourceKeys":["aws"],"verification":"Referenced","date":"2026-10-21","checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise.","context":"AWS MadPot exploitation-attempt source. Shared anonymization infrastructure; investigate rather than blanket-block.","limit":"Shared or reassigned addresses reduce attribution value.","references":[{"label":"AWS MadPot report","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"37.27.209.157","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-37-27-209-157","greynoise-event-37-27-209-157"],"evidence":[{"id":"greynoise-source-37-27-209-157","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Hetzner Online GmbH","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-23T09:00:47Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Hetzner Online GmbH. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-23T09:00:47Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-37-27-209-157","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"Hetzner Online GmbH","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Hetzner Online GmbH, AS24940, Finland. GreyNoise first_seen 2026-10-21; last seen 2026-10-28 11:09:15 UTC; 850 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"38.60.206.217","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-38-60-206-217"],"evidence":[{"id":"greynoise-event-38-60-206-217","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"LIGHT NODE LIMITED","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. LIGHT NODE LIMITED, AS154177, United States. GreyNoise first_seen 2026-09-29; last seen 2026-10-28 11:56:34 UTC; 55 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"38.180.45.91","sourceKeys":["offseq","greynoise","greynoiseEvents"],"aliases":["offseq-source-38-180-45-91","greynoise-event-38-180-45-91"],"evidence":[{"id":"offseq-source-38-180-45-91","sourceKeys":["offseq"],"verification":"Referenced","date":"2026-10-20 / 2026-10-22","checked":"2026-10-23","provenance":"OffSeq first-48-hours report: upload-progress requests, probes or memory-pressure bodies on low-interaction sensors; not demonstrated compromise.","context":"Find requests from OffSeq-reported probe and attempt sources. Some memory-pressure traffic was classified by request shape.","limit":"Investigation lead; shared infrastructure and fingerprints can overlap benign traffic.","references":[{"label":"OffSeq — first 48 hours","url":"https://offseq.com/en/research/php2shell-first-48-hours/","role":"Supporting reference"}]},{"id":"greynoise-event-38-180-45-91","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-21","organization":"Aktsiaselts WaveCom","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Aktsiaselts WaveCom, AS34702, Estonia. GreyNoise first_seen 2026-10-14; last seen 2026-10-21 22:21:13 UTC; 8 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"38.180.230.11","sourceKeys":["greynoise","greynoiseEvents","previdian"],"aliases":["greynoise-event-38-180-230-11","private-source-38-180-230-11"],"evidence":[{"id":"greynoise-event-38-180-230-11","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-21","organization":"Aktsiaselts WaveCom","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Aktsiaselts WaveCom, AS34702, Estonia. GreyNoise first_seen 2026-10-21; last seen 2026-10-21 22:33:56 UTC; 21 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]},{"id":"private-source-38-180-230-11","sourceKeys":["previdian"],"verification":"Unconfirmed","date":"2026-10-21","checked":"2026-10-23","firstSeen":"2026-10-21T22:29:41Z","lastSeen":"2026-10-21T22:33:58Z","observations":3,"provenance":"Supplied CVE-2026-109618-observations.json; Previdian. Not independently corroborated.","context":"Find requests from a source IP in the supplied Previdian observations.","limit":"Investigation lead, not a blocking recommendation.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json","role":"Related context only"}]}],"verification":"Mixed — see per-source evidence"},{"indicator":"38.180.230.216","sourceKeys":["greynoise","greynoiseEvents","previdian"],"aliases":["greynoise-event-38-180-230-216","private-source-38-180-230-216"],"evidence":[{"id":"greynoise-event-38-180-230-216","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"Aktsiaselts WaveCom","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Aktsiaselts WaveCom, AS34702, Estonia. GreyNoise first_seen 2026-10-19; last seen 2026-10-25 13:41:42 UTC; 207 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]},{"id":"private-source-38-180-230-216","sourceKeys":["previdian"],"verification":"Unconfirmed","date":"2026-10-22","checked":"2026-10-23","firstSeen":"2026-10-22T07:13:49Z","lastSeen":"2026-10-22T07:13:49Z","observations":1,"provenance":"Supplied CVE-2026-109618-observations.json; Previdian. Not independently corroborated.","context":"Find requests from a source IP in the supplied Previdian observations.","limit":"Investigation lead, not a blocking recommendation.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json","role":"Related context only"}]}],"verification":"Mixed — see per-source evidence"},{"indicator":"43.134.82.85","sourceKeys":["previdian"],"aliases":["private-source-43-134-82-85"],"evidence":[{"id":"private-source-43-134-82-85","sourceKeys":["previdian"],"verification":"Unconfirmed","date":"2026-10-21","checked":"2026-10-23","firstSeen":"2026-10-21T15:12:52Z","lastSeen":"2026-10-21T15:19:46Z","observations":2,"provenance":"Supplied CVE-2026-109618-observations.json; Previdian. Not independently corroborated.","context":"Find requests from a source IP in the supplied Previdian observations.","limit":"Investigation lead, not a blocking recommendation.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json","role":"Related context only"}]}],"verification":"Unconfirmed"},{"indicator":"43.173.9.190","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-43-173-9-190"],"evidence":[{"id":"greynoise-event-43-173-9-190","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"Tencent Building, Kejizhongyi Avenue","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Tencent Building, Kejizhongyi Avenue, AS132203, Indonesia. GreyNoise first_seen 2026-10-20; last seen 2026-10-30 04:21:57 UTC; 40 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"45.61.178.105","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-45-61-178-105"],"evidence":[{"id":"greynoise-source-45-61-178-105","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"RouterHosting LLC","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":2,"latestAlert":"2026-10-24T09:01:54Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: RouterHosting LLC. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 2; latest alert: 2026-10-24T09:01:54Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"45.78.14.116","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-45-78-14-116"],"evidence":[{"id":"greynoise-event-45-78-14-116","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"IT7 Networks Inc","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. IT7 Networks Inc, AS25820, United States. GreyNoise first_seen 2026-10-23; last seen 2026-10-23 12:43:18 UTC; 9 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"45.115.26.26","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-45-115-26-26"],"evidence":[{"id":"greynoise-event-45-115-26-26","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"SolidCore Hosting LTD","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. SolidCore Hosting LTD, AS199457, Germany. GreyNoise first_seen 2026-10-06; last seen 2026-10-28 14:21:16 UTC; 476 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"45.130.200.101","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-45-130-200-101"],"evidence":[{"id":"greynoise-event-45-130-200-101","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"Eisenia AB","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit. Eisenia AB, AS197854, Sweden. GreyNoise first_seen 2023-11-06; last seen 2026-10-30 05:48:17 UTC; 153 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"45.136.71.89","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-45-136-71-89","greynoise-event-45-136-71-89"],"evidence":[{"id":"greynoise-source-45-136-71-89","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Webdock.io ApS","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:02:38Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Webdock.io ApS. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-22T09:02:38Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-45-136-71-89","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Webdock.io ApS","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Webdock.io ApS, AS44803, Denmark. GreyNoise first_seen 2026-10-21; last seen 2026-10-23 06:49:55 UTC; 471 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"45.141.233.9","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-45-141-233-9"],"evidence":[{"id":"greynoise-source-45-141-233-9","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"MEVSPACE sp. z o.o.","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":2,"latestAlert":"2026-10-23T09:01:30Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: MEVSPACE sp. z o.o.. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 2; latest alert: 2026-10-23T09:01:30Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"45.148.10.80","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-45-148-10-80","greynoise-event-45-148-10-80"],"evidence":[{"id":"greynoise-source-45-148-10-80","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"TECHOFF SRV LIMITED","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-24T09:01:54Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: TECHOFF SRV LIMITED. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-24T09:01:54Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-45-148-10-80","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"TECHOFF SRV LIMITED","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. TECHOFF SRV LIMITED, AS48090, Netherlands. GreyNoise first_seen 2025-10-27; last seen 2026-10-30 05:01:43 UTC; 371 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"45.148.10.201","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-45-148-10-201","greynoise-event-45-148-10-201"],"evidence":[{"id":"greynoise-source-45-148-10-201","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"TECHOFF SRV LIMITED","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-24T09:01:54Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: TECHOFF SRV LIMITED. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-24T09:01:54Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-45-148-10-201","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"TECHOFF SRV LIMITED","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. TECHOFF SRV LIMITED, AS48090, Netherlands. GreyNoise first_seen 2024-09-17; last seen 2026-10-28 22:06:13 UTC; 512 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"45.156.87.44","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-45-156-87-44"],"evidence":[{"id":"greynoise-event-45-156-87-44","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"TechTies Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. TechTies Inc., AS197170, Netherlands. GreyNoise first_seen 2025-07-09; last seen 2026-10-30 06:08:43 UTC; 5783 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"45.156.129.57","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-45-156-129-57"],"evidence":[{"id":"greynoise-source-45-156-129-57","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"NSEC - Sistemas Informaticos, S.A.","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-23T09:01:30Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: NSEC - Sistemas Informaticos, S.A.. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-23T09:01:30Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"45.198.224.169","sourceKeys":["vulncheck","ellio","greynoise","greynoiseEvents"],"aliases":["reported-24","ellio-source-45-198-224-169","greynoise-event-45-198-224-169"],"evidence":[{"id":"reported-24","sourceKeys":["vulncheck"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Network / Timeline.","context":"Source observed in scanning, probing or exploitation-attempt traffic.","limit":"Shared or reassigned addresses reduce attribution value.","references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","role":"Supporting reference"}]},{"id":"ellio-source-45-198-224-169","sourceKeys":["ellio"],"verification":"Referenced","date":"2026-10-21","checked":"2026-10-23","provenance":"ELLIO report figure: A day of PHP2Shell requests, address by address. Nine source addresses observed on 21 October 2026 (UTC).","context":"Find inbound requests from a source IP in ELLIO’s 21 October timeline.","limit":"The timeline includes probes and exploit-like requests; an IP match alone does not establish compromise.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]},{"id":"greynoise-event-45-198-224-169","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"VPSVAULT.HOST LTD","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. VPSVAULT.HOST LTD, AS215925, Canada. GreyNoise first_seen 2026-10-01; last seen 2026-10-30 05:57:22 UTC; 6772 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"46.7.145.54","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-46-7-145-54"],"evidence":[{"id":"greynoise-event-46-7-145-54","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"Liberty Global Europe Holding B.V.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. Liberty Global Europe Holding B.V., AS6830, Ireland. GreyNoise first_seen 2026-10-22; last seen 2026-10-26 07:53:13 UTC; 699 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"46.37.123.14","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-46-37-123-14"],"evidence":[{"id":"greynoise-event-46-37-123-14","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"FREAKHOSTING LTD","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Request Memory Exhaustion, php2shell-Labeled Tooling. FREAKHOSTING LTD, AS215703, Germany. GreyNoise first_seen 2025-08-04; last seen 2026-10-30 06:06:26 UTC; 219 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"46.101.229.142","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-46-101-229-142"],"evidence":[{"id":"greynoise-event-46-101-229-142","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"DigitalOcean, LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. DigitalOcean, LLC, AS14061, Germany. GreyNoise first_seen 2026-03-15; last seen 2026-10-22 02:32:59 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"46.166.168.18","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-46-166-168-18"],"evidence":[{"id":"greynoise-source-46-166-168-18","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"UAB Cherry Servers","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-24T09:00:49Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: UAB Cherry Servers. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-24T09:00:49Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"46.205.208.16","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-46-205-208-16"],"evidence":[{"id":"greynoise-event-46-205-208-16","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"T-Mobile Polska S.A.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. T-Mobile Polska S.A., AS12912, Poland. GreyNoise first_seen 2026-06-06; last seen 2026-10-28 22:20:14 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"47.250.155.133","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-47-250-155-133"],"evidence":[{"id":"greynoise-event-47-250-155-133","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"Alibaba (US) Technology Co., Ltd.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Memory Corruption Exploit, Request Memory Exhaustion. Alibaba (US) Technology Co., Ltd., AS45102, Malaysia. GreyNoise first_seen 2026-10-23; last seen 2026-10-30 02:41:28 UTC; 2538 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"51.83.187.123","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-51-83-187-123"],"evidence":[{"id":"greynoise-event-51-83-187-123","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"OVH SAS","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. OVH SAS, AS16276, Poland. GreyNoise first_seen 2026-10-29; last seen 2026-10-29 21:08:55 UTC; 145 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"51.143.62.244","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-51-143-62-244"],"evidence":[{"id":"greynoise-event-51-143-62-244","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Microsoft Corporation","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, Session Poisoning, php2shell-Labeled Tooling. Microsoft Corporation, AS8075, United States. GreyNoise first_seen 2025-12-06; last seen 2026-10-22 00:57:17 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"52.17.252.187","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-52-17-252-187","greynoise-event-52-17-252-187"],"evidence":[{"id":"greynoise-source-52-17-252-187","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Amazon.com, Inc.","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:00:47Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Amazon.com, Inc.. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-22T09:00:47Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-52-17-252-187","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Amazon.com, Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Amazon.com, Inc., AS16509, Ireland. GreyNoise first_seen 2026-10-12; last seen 2026-10-22 08:17:50 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"52.53.131.214","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-52-53-131-214"],"evidence":[{"id":"greynoise-event-52-53-131-214","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Amazon.com, Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Amazon.com, Inc., AS16509, United States. GreyNoise first_seen 2026-10-22; last seen 2026-10-22 16:34:05 UTC; 42 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"52.53.211.104","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-52-53-211-104"],"evidence":[{"id":"greynoise-event-52-53-211-104","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Amazon.com, Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Amazon.com, Inc., AS16509, United States. GreyNoise first_seen 2026-10-21; last seen 2026-10-22 05:05:24 UTC; 46 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"52.172.142.28","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-52-172-142-28"],"evidence":[{"id":"greynoise-source-52-172-142-28","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Microsoft Corporation","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-24T09:00:49Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Microsoft Corporation. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-24T09:00:49Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"52.250.54.233","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-52-250-54-233"],"evidence":[{"id":"greynoise-event-52-250-54-233","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Microsoft Corporation","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Microsoft Corporation, AS8075, United States. GreyNoise first_seen 2026-03-09; last seen 2026-10-22 04:38:05 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"54.149.222.88","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-54-149-222-88"],"evidence":[{"id":"greynoise-source-54-149-222-88","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Amazon.com, Inc.","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":3,"latestAlert":"2026-10-21T14:01:05Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Amazon.com, Inc.. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 3; latest alert: 2026-10-21T14:01:05Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"54.154.150.2","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-54-154-150-2"],"evidence":[{"id":"greynoise-event-54-154-150-2","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Amazon.com, Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Amazon.com, Inc., AS16509, Ireland. GreyNoise first_seen 2026-10-22; last seen 2026-10-22 04:46:55 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"57.129.80.197","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-57-129-80-197"],"evidence":[{"id":"greynoise-event-57-129-80-197","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"OVH SAS","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. OVH SAS, AS16276, Germany. GreyNoise first_seen 2026-10-07; last seen 2026-10-26 15:09:17 UTC; 708 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"63.186.150.111","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-63-186-150-111"],"evidence":[{"id":"greynoise-event-63-186-150-111","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Amazon.com, Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Session Poisoning. Amazon.com, Inc., AS16509, Germany. GreyNoise first_seen 2026-10-21; last seen 2026-10-22 10:13:53 UTC; 132 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"64.111.92.102","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-64-111-92-102","greynoise-event-64-111-92-102"],"evidence":[{"id":"greynoise-source-64-111-92-102","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"BL Networks","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-24T09:00:49Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: BL Networks. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-24T09:00:49Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-64-111-92-102","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-24","organization":"BL Networks","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. BL Networks, AS399629, Netherlands. GreyNoise first_seen 2026-10-22; last seen 2026-10-24 05:59:55 UTC; 10 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"64.227.149.251","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-64-227-149-251"],"evidence":[{"id":"greynoise-event-64-227-149-251","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"DigitalOcean, LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. DigitalOcean, LLC, AS14061, India. GreyNoise first_seen 2023-09-21; last seen 2026-10-29 03:00:50 UTC; 3 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"66.116.196.142","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-66-116-196-142"],"evidence":[{"id":"greynoise-source-66-116-196-142","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Oracle Corporation","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":3,"latestAlert":"2026-10-21T14:01:05Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Oracle Corporation. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 3; latest alert: 2026-10-21T14:01:05Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"67.205.129.138","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-67-205-129-138"],"evidence":[{"id":"greynoise-event-67-205-129-138","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"DigitalOcean, LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. DigitalOcean, LLC, AS14061, United States. GreyNoise first_seen 2026-10-20; last seen 2026-10-25 03:55:56 UTC; 875 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"72.251.215.19","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-72-251-215-19"],"evidence":[{"id":"greynoise-event-72-251-215-19","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Proton AG","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Proton AG, AS208172, Israel. GreyNoise first_seen 2026-07-21; last seen 2026-10-22 14:30:45 UTC; 7 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"74.208.16.253","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-74-208-16-253"],"evidence":[{"id":"greynoise-source-74-208-16-253","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"IONOS SE","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-24T09:01:54Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: IONOS SE. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-24T09:01:54Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"74.208.79.255","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-74-208-79-255"],"evidence":[{"id":"greynoise-source-74-208-79-255","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"IONOS SE","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-24T09:01:54Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: IONOS SE. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-24T09:01:54Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"74.208.167.97","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-74-208-167-97"],"evidence":[{"id":"greynoise-source-74-208-167-97","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"IONOS SE","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-24T09:01:54Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: IONOS SE. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-24T09:01:54Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"74.208.242.33","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-74-208-242-33"],"evidence":[{"id":"greynoise-event-74-208-242-33","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"IONOS SE","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. IONOS SE, AS8560, United States. GreyNoise first_seen 2026-09-23; last seen 2026-10-22 13:58:40 UTC; 4 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"75.119.143.189","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-75-119-143-189"],"evidence":[{"id":"greynoise-event-75-119-143-189","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"Contabo GmbH","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Contabo GmbH, AS51167, France. GreyNoise first_seen 2026-10-21; last seen 2026-10-25 23:44:37 UTC; 308 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"77.90.185.20","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-77-90-185-20","greynoise-event-77-90-185-20"],"evidence":[{"id":"greynoise-source-77-90-185-20","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Limited Network LTD","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-23T09:01:30Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Limited Network LTD. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-23T09:01:30Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-77-90-185-20","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"Limited Network LTD","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. Limited Network LTD, AS213790, Lithuania. GreyNoise first_seen 2023-07-05; last seen 2026-10-30 06:12:44 UTC; 7081 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"77.91.113.125","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-77-91-113-125"],"evidence":[{"id":"greynoise-event-77-91-113-125","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"HOSTKEY B.V.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. HOSTKEY B.V., AS50867, Russia. GreyNoise first_seen 2026-10-24; last seen 2026-10-29 14:54:07 UTC; 93 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"77.239.124.121","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-77-239-124-121"],"evidence":[{"id":"greynoise-event-77-239-124-121","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"BANATSYNC SRL","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. BANATSYNC SRL, AS198364, Netherlands. GreyNoise first_seen 2026-08-13; last seen 2026-10-30 05:29:45 UTC; 7030 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"77.243.184.207","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-77-243-184-207"],"evidence":[{"id":"greynoise-event-77-243-184-207","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"M247 Europe SRL","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. M247 Europe SRL, AS9009, Switzerland. GreyNoise first_seen 2026-10-26; last seen 2026-10-26 14:37:22 UTC; 7 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"78.47.85.99","sourceKeys":["greynoise","greynoiseEvents","previdian"],"aliases":["greynoise-event-78-47-85-99","private-source-78-47-85-99"],"evidence":[{"id":"greynoise-event-78-47-85-99","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Hetzner Online GmbH","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Hetzner Online GmbH, AS24940, Germany. GreyNoise first_seen 2026-10-21; last seen 2026-10-23 04:05:58 UTC; 550 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]},{"id":"private-source-78-47-85-99","sourceKeys":["previdian"],"verification":"Unconfirmed","date":"2026-10-22","checked":"2026-10-23","firstSeen":"2026-10-22T05:15:18Z","lastSeen":"2026-10-22T05:17:24Z","observations":2,"provenance":"Supplied CVE-2026-109618-observations.json; Previdian. Not independently corroborated.","context":"Find requests from a source IP in the supplied Previdian observations.","limit":"Investigation lead, not a blocking recommendation.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json","role":"Related context only"}]}],"verification":"Mixed — see per-source evidence"},{"indicator":"79.110.49.21","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-79-110-49-21"],"evidence":[{"id":"greynoise-event-79-110-49-21","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"12651980 CANADA INC.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. 12651980 CANADA INC., AS399486, France. GreyNoise first_seen 2026-10-22; last seen 2026-10-22 19:19:38 UTC; 352 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"79.193.197.168","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-79-193-197-168"],"evidence":[{"id":"greynoise-event-79-193-197-168","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Deutsche Telekom AG","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, Session Poisoning, php2shell-Labeled Tooling. Deutsche Telekom AG, AS3320, Germany. GreyNoise first_seen 2026-10-21; last seen 2026-10-22 14:41:24 UTC; 3 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"80.66.66.66","sourceKeys":["offseq"],"aliases":["offseq-source-80-66-66-66"],"evidence":[{"id":"offseq-source-80-66-66-66","sourceKeys":["offseq"],"verification":"Referenced","date":"2026-10-20 / 2026-10-22","checked":"2026-10-23","provenance":"OffSeq first-48-hours report: upload-progress requests, probes or memory-pressure bodies on low-interaction sensors; not demonstrated compromise.","context":"Find requests from OffSeq-reported probe and attempt sources. Some memory-pressure traffic was classified by request shape.","limit":"Investigation lead; shared infrastructure and fingerprints can overlap benign traffic.","references":[{"label":"OffSeq — first 48 hours","url":"https://offseq.com/en/research/php2shell-first-48-hours/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"81.28.4.17","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-81-28-4-17","greynoise-event-81-28-4-17"],"evidence":[{"id":"greynoise-source-81-28-4-17","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Kamatera Inc","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":3,"latestAlert":"2026-10-23T09:01:30Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Kamatera Inc. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 3; latest alert: 2026-10-23T09:01:30Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-81-28-4-17","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"Kamatera Inc","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Kamatera Inc, AS210329, United Kingdom. GreyNoise first_seen 2026-10-21; last seen 2026-10-25 15:59:11 UTC; 454 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"82.221.101.119","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-82-221-101-119"],"evidence":[{"id":"greynoise-event-82-221-101-119","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Advania Island ehf","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit. Advania Island ehf, AS50613, Iceland. GreyNoise first_seen 2026-10-23; last seen 2026-10-23 16:01:24 UTC; 8 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"83.21.173.138","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-83-21-173-138"],"evidence":[{"id":"greynoise-event-83-21-173-138","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-27","organization":"Orange Polska Spolka Akcyjna","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Orange Polska Spolka Akcyjna, AS5617, Poland. GreyNoise first_seen 2026-10-27; last seen 2026-10-27 11:12:45 UTC; 8 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"83.147.13.219","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-83-147-13-219"],"evidence":[{"id":"greynoise-event-83-147-13-219","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"AkileCloud Network","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. AkileCloud Network, AS61112, Taiwan. GreyNoise first_seen 2026-10-29; last seen 2026-10-29 22:08:24 UTC; 3 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"85.11.167.243","sourceKeys":["vulncheck","ellio","greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["reported-23","ellio-source-85-11-167-243","greynoise-source-85-11-167-243","greynoise-event-85-11-167-243"],"evidence":[{"id":"reported-23","sourceKeys":["vulncheck"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Network / Timeline.","context":"Source observed in scanning, probing or exploitation-attempt traffic.","limit":"Shared or reassigned addresses reduce attribution value.","references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","role":"Supporting reference"}]},{"id":"ellio-source-85-11-167-243","sourceKeys":["ellio"],"verification":"Referenced","date":"2026-10-21","checked":"2026-10-23","provenance":"ELLIO report figure: A day of PHP2Shell requests, address by address. Nine source addresses observed on 21 October 2026 (UTC).","context":"Find inbound requests from a source IP in ELLIO’s 21 October timeline.","limit":"The timeline includes probes and exploit-like requests; an IP match alone does not establish compromise.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]},{"id":"greynoise-source-85-11-167-243","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"TechTies Inc.","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":3,"latestAlert":"2026-10-21T14:00:45Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: TechTies Inc.. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 3; latest alert: 2026-10-21T14:00:45Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-85-11-167-243","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"TechTies Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Session Poisoning, php2shell-Labeled Tooling. TechTies Inc., AS197170, Netherlands. GreyNoise first_seen 2026-09-03; last seen 2026-10-22 15:26:01 UTC; 5771 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"85.11.190.112","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-85-11-190-112","greynoise-event-85-11-190-112"],"evidence":[{"id":"greynoise-source-85-11-190-112","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"IP Vendetta Inc.","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":2,"latestAlert":"2026-10-24T09:01:54Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: IP Vendetta Inc.. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 2; latest alert: 2026-10-24T09:01:54Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-85-11-190-112","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"IP Vendetta Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. IP Vendetta Inc., AS209101, Netherlands. GreyNoise first_seen 2026-10-22; last seen 2026-10-30 00:44:36 UTC; 4494 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"85.199.255.137","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-85-199-255-137"],"evidence":[{"id":"greynoise-event-85-199-255-137","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"M247 Europe SRL","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. M247 Europe SRL, AS9009, Singapore. GreyNoise first_seen 2026-10-29; last seen 2026-10-29 06:05:58 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"87.192.237.19","sourceKeys":["offseq"],"aliases":["offseq-source-87-192-237-19"],"evidence":[{"id":"offseq-source-87-192-237-19","sourceKeys":["offseq"],"verification":"Referenced","date":"2026-10-20 / 2026-10-22","checked":"2026-10-23","provenance":"OffSeq first-48-hours report: upload-progress requests, probes or memory-pressure bodies on low-interaction sensors; not demonstrated compromise.","context":"Find requests from OffSeq-reported probe and attempt sources. Some memory-pressure traffic was classified by request shape.","limit":"Investigation lead; shared infrastructure and fingerprints can overlap benign traffic.","references":[{"label":"OffSeq — first 48 hours","url":"https://offseq.com/en/research/php2shell-first-48-hours/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"88.216.36.31","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-88-216-36-31"],"evidence":[{"id":"greynoise-source-88-216-36-31","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"UAB Cherry Servers","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-24T09:00:49Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: UAB Cherry Servers. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-24T09:00:49Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"89.37.63.57","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-89-37-63-57"],"evidence":[{"id":"greynoise-event-89-37-63-57","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"Datacamp Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Request Memory Exhaustion, php2shell-Labeled Tooling. Datacamp Limited, AS212238, Sweden. GreyNoise first_seen 2025-03-08; last seen 2026-10-25 11:14:46 UTC; 5 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"89.37.63.146","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-89-37-63-146"],"evidence":[{"id":"greynoise-event-89-37-63-146","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"Datacamp Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Datacamp Limited, AS212238, Sweden. GreyNoise first_seen 2025-07-30; last seen 2026-10-25 05:44:28 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"89.37.63.204","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-89-37-63-204"],"evidence":[{"id":"greynoise-event-89-37-63-204","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-21","organization":"Datacamp Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. Datacamp Limited, AS212238, Sweden. GreyNoise first_seen 2025-06-04; last seen 2026-10-21 20:48:29 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"89.37.63.248","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-89-37-63-248"],"evidence":[{"id":"greynoise-event-89-37-63-248","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"Datacamp Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Datacamp Limited, AS212238, Sweden. GreyNoise first_seen 2025-02-21; last seen 2026-10-25 05:20:19 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"89.125.59.156","sourceKeys":["greynoise","greynoiseEvents","previdian"],"aliases":["greynoise-event-89-125-59-156","private-source-89-125-59-156"],"evidence":[{"id":"greynoise-event-89-125-59-156","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Snowd Security OU","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Snowd Security OU, AS213459, Finland. GreyNoise first_seen 2026-10-21; last seen 2026-10-22 00:04:04 UTC; 55 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]},{"id":"private-source-89-125-59-156","sourceKeys":["previdian"],"verification":"Unconfirmed","date":"2026-10-21","checked":"2026-10-23","firstSeen":"2026-10-21T23:57:29Z","lastSeen":"2026-10-21T23:57:29Z","observations":1,"provenance":"Supplied CVE-2026-109618-observations.json; Previdian. Not independently corroborated.","context":"Find requests from a source IP in the supplied Previdian observations.","limit":"Investigation lead, not a blocking recommendation.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json","role":"Related context only"}]}],"verification":"Mixed — see per-source evidence"},{"indicator":"90.155.6.87","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-90-155-6-87"],"evidence":[{"id":"greynoise-event-90-155-6-87","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"Andrews & Arnold Ltd","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Andrews & Arnold Ltd, AS20712, United Kingdom. GreyNoise first_seen 2026-10-22; last seen 2026-10-26 03:51:48 UTC; 576 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"91.90.123.25","sourceKeys":["vulncheck"],"aliases":["reported-27"],"evidence":[{"id":"reported-27","sourceKeys":["vulncheck"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Network / Timeline.","context":"Source observed in scanning, probing or exploitation-attempt traffic.","limit":"Shared or reassigned addresses reduce attribution value.","references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"92.51.2.85","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-92-51-2-85"],"evidence":[{"id":"greynoise-event-92-51-2-85","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"Flyservers S.A.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Session Poisoning. Flyservers S.A., AS209588, Russia. GreyNoise first_seen 2026-09-28; last seen 2026-10-30 05:38:33 UTC; 65 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"92.88.170.153","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-92-88-170-153"],"evidence":[{"id":"greynoise-event-92-88-170-153","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"Societe Francaise Du Radiotelephone - SFR SA","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Societe Francaise Du Radiotelephone - SFR SA, AS15557, France. GreyNoise first_seen 2024-04-21; last seen 2026-10-26 20:28:20 UTC; 3 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"94.130.216.171","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-94-130-216-171"],"evidence":[{"id":"greynoise-event-94-130-216-171","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"Hetzner Online GmbH","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Hetzner Online GmbH, AS24940, Germany. GreyNoise first_seen 2023-05-21; last seen 2026-10-28 16:54:30 UTC; 10 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"94.154.43.7","sourceKeys":["ellio","offseq","greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["ellio-source-94-154-43-7","offseq-source-94-154-43-7","greynoise-source-94-154-43-7","greynoise-event-94-154-43-7"],"evidence":[{"id":"ellio-source-94-154-43-7","sourceKeys":["ellio"],"verification":"Referenced","date":"2026-10-21","checked":"2026-10-23","provenance":"ELLIO report figure: A day of PHP2Shell requests, address by address. Nine source addresses observed on 21 October 2026 (UTC).","context":"Find inbound requests from a source IP in ELLIO’s 21 October timeline.","limit":"The timeline includes probes and exploit-like requests; an IP match alone does not establish compromise.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]},{"id":"offseq-source-94-154-43-7","sourceKeys":["offseq"],"verification":"Referenced","date":"2026-10-20 / 2026-10-22","checked":"2026-10-23","provenance":"OffSeq first-48-hours report: upload-progress requests, probes or memory-pressure bodies on low-interaction sensors; not demonstrated compromise.","context":"Find requests from OffSeq-reported probe and attempt sources. Some memory-pressure traffic was classified by request shape.","limit":"Investigation lead; shared infrastructure and fingerprints can overlap benign traffic.","references":[{"label":"OffSeq — first 48 hours","url":"https://offseq.com/en/research/php2shell-first-48-hours/","role":"Supporting reference"}]},{"id":"greynoise-source-94-154-43-7","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Storm Industries LLC","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":2,"latestAlert":"2026-10-22T09:02:38Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Storm Industries LLC. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 2; latest alert: 2026-10-22T09:02:38Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-94-154-43-7","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"Storm Industries LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion. Storm Industries LLC, AS219502, Netherlands. GreyNoise first_seen 2025-12-15; last seen 2026-10-28 17:14:40 UTC; 7053 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"94.154.43.100","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-94-154-43-100"],"evidence":[{"id":"greynoise-event-94-154-43-100","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"Storm Industries LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. Storm Industries LLC, AS219502, Netherlands. GreyNoise first_seen 2025-12-15; last seen 2026-10-29 06:12:02 UTC; 7081 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"94.154.43.149","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-94-154-43-149"],"evidence":[{"id":"greynoise-event-94-154-43-149","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"Storm Industries LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. Storm Industries LLC, AS219502, Netherlands. GreyNoise first_seen 2025-12-15; last seen 2026-10-29 02:59:07 UTC; 5917 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"94.154.43.185","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-94-154-43-185"],"evidence":[{"id":"greynoise-event-94-154-43-185","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"Storm Industries LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. Storm Industries LLC, AS219502, Netherlands. GreyNoise first_seen 2025-12-15; last seen 2026-10-28 00:07:07 UTC; 5853 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"94.154.43.187","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-94-154-43-187"],"evidence":[{"id":"greynoise-event-94-154-43-187","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"Storm Industries LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. Storm Industries LLC, AS219502, Netherlands. GreyNoise first_seen 2025-12-16; last seen 2026-10-28 00:07:13 UTC; 5849 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"94.154.43.189","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-94-154-43-189"],"evidence":[{"id":"greynoise-event-94-154-43-189","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"Storm Industries LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. Storm Industries LLC, AS219502, Netherlands. GreyNoise first_seen 2025-12-16; last seen 2026-10-30 06:01:09 UTC; 5895 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"94.154.43.222","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-94-154-43-222"],"evidence":[{"id":"greynoise-source-94-154-43-222","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Storm Industries LLC","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:00:47Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Storm Industries LLC. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-22T09:00:47Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"95.139.123.158","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-95-139-123-158"],"evidence":[{"id":"greynoise-event-95-139-123-158","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"MTS PJSC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. MTS PJSC, AS8359, Russia. GreyNoise first_seen 2026-05-25; last seen 2026-10-29 19:48:00 UTC; 13 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"95.216.5.90","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-95-216-5-90","greynoise-event-95-216-5-90"],"evidence":[{"id":"greynoise-source-95-216-5-90","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Hetzner Online GmbH","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":3,"latestAlert":"2026-10-23T09:01:30Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Hetzner Online GmbH. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 3; latest alert: 2026-10-23T09:01:30Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-95-216-5-90","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Hetzner Online GmbH","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Hetzner Online GmbH, AS24940, Finland. GreyNoise first_seen 2026-10-21; last seen 2026-10-23 10:57:16 UTC; 1568 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"95.217.98.37","sourceKeys":["aws"],"aliases":["reported-6"],"evidence":[{"id":"reported-6","sourceKeys":["aws"],"verification":"Referenced","date":"2026-10-21","checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise.","context":"AWS MadPot exploitation-attempt source. Shared anonymization infrastructure; investigate rather than blanket-block.","limit":"Shared or reassigned addresses reduce attribution value.","references":[{"label":"AWS MadPot report","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"95.217.164.124","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-95-217-164-124"],"evidence":[{"id":"greynoise-event-95-217-164-124","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Hetzner Online GmbH","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Session Poisoning. Hetzner Online GmbH, AS24940, Finland. GreyNoise first_seen 2020-03-09; last seen 2026-10-23 07:48:01 UTC; 322 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"98.80.11.91","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-98-80-11-91","greynoise-event-98-80-11-91"],"evidence":[{"id":"greynoise-source-98-80-11-91","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Amazon.com, Inc.","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:02:38Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Amazon.com, Inc.. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-22T09:02:38Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-98-80-11-91","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Amazon.com, Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Amazon.com, Inc., AS14618, United States. GreyNoise first_seen 2026-10-22; last seen 2026-10-22 16:00:42 UTC; 36 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"98.98.47.154","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-98-98-47-154"],"evidence":[{"id":"greynoise-event-98-98-47-154","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"Zenlayer Inc","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Zenlayer Inc, AS21859, Malaysia. GreyNoise first_seen 2025-03-23; last seen 2026-10-25 05:02:50 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"101.36.114.102","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-101-36-114-102"],"evidence":[{"id":"greynoise-event-101-36-114-102","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, AS135377, South Korea. GreyNoise first_seen 2021-06-02; last seen 2026-10-26 06:54:04 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"101.128.110.145","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-101-128-110-145"],"evidence":[{"id":"greynoise-event-101-128-110-145","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"PT. Cyberindo Aditama","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Memory Corruption Exploit. PT. Cyberindo Aditama, AS135478, Indonesia. GreyNoise first_seen 2026-10-22; last seen 2026-10-26 17:49:19 UTC; 31 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"102.207.250.188","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-102-207-250-188","greynoise-event-102-207-250-188"],"evidence":[{"id":"greynoise-source-102-207-250-188","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"UNIPACK","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:02:38Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: UNIPACK. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-22T09:02:38Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-102-207-250-188","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"UNIPACK","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. UNIPACK, AS328307, Tunisia. GreyNoise first_seen 2026-10-22; last seen 2026-10-25 22:16:12 UTC; 827 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"102.210.149.166","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-102-210-149-166"],"evidence":[{"id":"greynoise-source-102-210-149-166","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"THE KONZA TECHNOPOLIS DEVELOPMENT AUTHORITY","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":3,"latestAlert":"2026-10-21T14:01:05Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: THE KONZA TECHNOPOLIS DEVELOPMENT AUTHORITY. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 3; latest alert: 2026-10-21T14:01:05Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"103.114.163.188","sourceKeys":["aws"],"aliases":["reported-5"],"evidence":[{"id":"reported-5","sourceKeys":["aws"],"verification":"Referenced","date":"2026-10-21","checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise.","context":"AWS MadPot exploitation-attempt source. Shared anonymization infrastructure; investigate rather than blanket-block.","limit":"Shared or reassigned addresses reduce attribution value.","references":[{"label":"AWS MadPot report","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"103.131.131.168","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-103-131-131-168"],"evidence":[{"id":"greynoise-source-103-131-131-168","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Hyonix","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-21T14:01:05Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Hyonix. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-21T14:01:05Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"103.149.183.197","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-103-149-183-197"],"evidence":[{"id":"greynoise-event-103-149-183-197","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"Yun Zhong Technology Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Yun Zhong Technology Limited, AS151630, Hong Kong. GreyNoise first_seen 2026-10-26; last seen 2026-10-26 10:48:20 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"103.151.172.95","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-103-151-172-95"],"evidence":[{"id":"greynoise-event-103-151-172-95","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"IKUUU NETWORK LTD","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit. IKUUU NETWORK LTD, AS134972, Hong Kong. GreyNoise first_seen 2022-03-01; last seen 2026-10-26 21:05:45 UTC; 37 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"103.204.193.27","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-103-204-193-27","greynoise-event-103-204-193-27"],"evidence":[{"id":"greynoise-source-103-204-193-27","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"HOSTBITS SOLUCOES EM NUVEM LTDA","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-23T09:00:47Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: HOSTBITS SOLUCOES EM NUVEM LTDA. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-23T09:00:47Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-103-204-193-27","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"HOSTBITS SOLUCOES EM NUVEM LTDA","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. HOSTBITS SOLUCOES EM NUVEM LTDA, AS211305, Brazil. GreyNoise first_seen 2026-10-21; last seen 2026-10-28 01:42:12 UTC; 387 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"103.216.220.92","sourceKeys":["aws"],"aliases":["reported-1"],"evidence":[{"id":"reported-1","sourceKeys":["aws"],"verification":"Referenced","date":"2026-10-17","checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise.","context":"AWS MadPot exploitation-attempt source. Shared anonymization infrastructure; investigate rather than blanket-block.","limit":"Shared or reassigned addresses reduce attribution value.","references":[{"label":"AWS MadPot report","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"104.28.221.228","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-104-28-221-228"],"evidence":[{"id":"greynoise-event-104-28-221-228","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-27","organization":"Cloudflare, Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Cloudflare, Inc., AS13335, Algeria. GreyNoise first_seen 2025-03-05; last seen 2026-10-27 13:07:35 UTC; 17 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"104.28.233.170","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-104-28-233-170"],"evidence":[{"id":"greynoise-source-104-28-233-170","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Cloudflare, Inc.","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:00:47Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Cloudflare, Inc.. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-22T09:00:47Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"104.243.29.169","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-104-243-29-169"],"evidence":[{"id":"greynoise-event-104-243-29-169","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-24","organization":"IT7 Networks Inc","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. IT7 Networks Inc, AS25820, United States. GreyNoise first_seen 2026-10-20; last seen 2026-10-24 13:18:21 UTC; 30 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"105.156.180.134","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-105-156-180-134"],"evidence":[{"id":"greynoise-event-105-156-180-134","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM, AS36903, Morocco. GreyNoise first_seen 2026-10-22; last seen 2026-10-22 16:16:40 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"109.71.252.97","sourceKeys":["vulncheck"],"aliases":["reported-25"],"evidence":[{"id":"reported-25","sourceKeys":["vulncheck"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Network / Timeline.","context":"Source observed in scanning, probing or exploitation-attempt traffic.","limit":"Shared or reassigned addresses reduce attribution value.","references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"109.120.147.103","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-109-120-147-103"],"evidence":[{"id":"greynoise-event-109-120-147-103","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"NetCrafters OU","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. NetCrafters OU, AS203273, Netherlands. GreyNoise first_seen 2026-10-23; last seen 2026-10-23 16:13:01 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"112.66.197.171","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-112-66-197-171"],"evidence":[{"id":"greynoise-event-112-66-197-171","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"CHINANET BACKBONE","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. CHINANET BACKBONE, AS4134, China. GreyNoise first_seen 2026-10-25; last seen 2026-10-25 09:48:06 UTC; 14 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"112.66.198.12","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-112-66-198-12"],"evidence":[{"id":"greynoise-event-112-66-198-12","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"CHINANET BACKBONE","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. CHINANET BACKBONE, AS4134, China. GreyNoise first_seen 2020-03-05; last seen 2026-10-23 17:20:58 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"114.26.103.72","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-114-26-103-72"],"evidence":[{"id":"greynoise-event-114-26-103-72","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Data Communication Business Group","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Data Communication Business Group, AS3462, Taiwan. GreyNoise first_seen 2023-01-25; last seen 2026-10-22 03:05:21 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"116.251.216.106","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-116-251-216-106"],"evidence":[{"id":"greynoise-event-116-251-216-106","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"OneAsiaHost","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. OneAsiaHost, AS59211, Singapore. GreyNoise first_seen 2026-08-06; last seen 2026-10-26 14:10:01 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"116.251.216.117","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-116-251-216-117"],"evidence":[{"id":"greynoise-event-116-251-216-117","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"OneAsiaHost","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. OneAsiaHost, AS59211, Singapore. GreyNoise first_seen 2026-08-05; last seen 2026-10-26 14:10:10 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"119.59.101.74","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-119-59-101-74"],"evidence":[{"id":"greynoise-event-119-59-101-74","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"453 Ladplacout Jorakhaebua","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, Session Poisoning, php2shell-Labeled Tooling. 453 Ladplacout Jorakhaebua, AS56067, Thailand. GreyNoise first_seen 2026-05-10; last seen 2026-10-23 13:38:37 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"120.235.218.21","sourceKeys":["previdian"],"aliases":["private-source-120-235-218-21"],"evidence":[{"id":"private-source-120-235-218-21","sourceKeys":["previdian"],"verification":"Unconfirmed","date":"2026-10-21","checked":"2026-10-23","firstSeen":"2026-10-21T19:57:45Z","lastSeen":"2026-10-21T19:57:45Z","observations":2,"provenance":"Supplied CVE-2026-109618-observations.json; Previdian. Not independently corroborated.","context":"Find requests from a source IP in the supplied Previdian observations.","limit":"Investigation lead, not a blocking recommendation.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json","role":"Related context only"}]}],"verification":"Unconfirmed"},{"indicator":"121.127.33.74","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-121-127-33-74"],"evidence":[{"id":"greynoise-event-121-127-33-74","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-27","organization":"Privex Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Privex Inc., AS210083, Sweden. GreyNoise first_seen 2026-06-17; last seen 2026-10-27 19:30:59 UTC; 6 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"123.25.115.82","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-123-25-115-82"],"evidence":[{"id":"greynoise-event-123-25-115-82","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"VNPT Corp","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Session Poisoning. VNPT Corp, AS45899, Vietnam. GreyNoise first_seen 2026-10-21; last seen 2026-10-22 14:02:06 UTC; 225 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"129.153.133.23","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-129-153-133-23","greynoise-event-129-153-133-23"],"evidence":[{"id":"greynoise-source-129-153-133-23","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Oracle Corporation","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-21T14:01:05Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Oracle Corporation. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-21T14:01:05Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-129-153-133-23","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-21","organization":"Oracle Corporation","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. Oracle Corporation, AS31898, United States. GreyNoise first_seen 2026-06-16; last seen 2026-10-21 14:50:29 UTC; 16 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"130.12.180.42","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-130-12-180-42"],"evidence":[{"id":"greynoise-event-130-12-180-42","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"Omegatech LTD","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion. Omegatech LTD, AS202412, Germany. GreyNoise first_seen 2026-02-06; last seen 2026-10-25 05:43:48 UTC; 6904 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"134.209.159.64","sourceKeys":["aws"],"aliases":["reported-4"],"evidence":[{"id":"reported-4","sourceKeys":["aws"],"verification":"Referenced","date":"2026-10-21","checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise.","context":"AWS MadPot exploitation-attempt source. Shared anonymization infrastructure; investigate rather than blanket-block.","limit":"Shared or reassigned addresses reduce attribution value.","references":[{"label":"AWS MadPot report","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"134.209.252.157","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-134-209-252-157"],"evidence":[{"id":"greynoise-event-134-209-252-157","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"DigitalOcean, LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. DigitalOcean, LLC, AS14061, Germany. GreyNoise first_seen 2025-11-18; last seen 2026-10-25 23:13:09 UTC; 463 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"138.199.43.94","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-138-199-43-94"],"evidence":[{"id":"greynoise-event-138-199-43-94","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"Datacamp Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Datacamp Limited, AS212238, United States. GreyNoise first_seen 2025-10-14; last seen 2026-10-30 00:43:36 UTC; 45 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"141.94.33.148","sourceKeys":["greynoise","greynoiseCsv","previdian"],"aliases":["greynoise-source-141-94-33-148","private-source-141-94-33-148"],"evidence":[{"id":"greynoise-source-141-94-33-148","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"OVH SAS","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:00:47Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: OVH SAS. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-22T09:00:47Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"private-source-141-94-33-148","sourceKeys":["previdian"],"verification":"Unconfirmed","date":"2026-10-22","checked":"2026-10-23","firstSeen":"2026-10-22T00:01:21Z","lastSeen":"2026-10-22T00:01:21Z","observations":1,"provenance":"Supplied CVE-2026-109618-observations.json; Previdian. Not independently corroborated.","context":"Find requests from a source IP in the supplied Previdian observations.","limit":"Investigation lead, not a blocking recommendation.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json","role":"Related context only"}]}],"verification":"Mixed — see per-source evidence"},{"indicator":"141.98.255.191","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-141-98-255-191"],"evidence":[{"id":"greynoise-event-141-98-255-191","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"31173 Services AB","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. 31173 Services AB, AS39351, Sweden. GreyNoise first_seen 2025-04-26; last seen 2026-10-28 21:14:10 UTC; 7 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"141.98.255.246","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-141-98-255-246"],"evidence":[{"id":"greynoise-event-141-98-255-246","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"31173 Services AB","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion. 31173 Services AB, AS39351, Sweden. GreyNoise first_seen 2026-09-22; last seen 2026-10-29 21:35:16 UTC; 890 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"143.246.213.138","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-143-246-213-138"],"evidence":[{"id":"greynoise-event-143-246-213-138","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"AVA HOST SRL","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. AVA HOST SRL, AS48753, Moldova. GreyNoise first_seen 2026-10-20; last seen 2026-10-29 23:25:14 UTC; 13 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"144.31.90.126","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-144-31-90-126"],"evidence":[{"id":"greynoise-event-144-31-90-126","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"H2NEXUS CLOUD SERVICES - FZCO","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. H2NEXUS CLOUD SERVICES - FZCO, AS215730, Finland. GreyNoise first_seen 2026-09-08; last seen 2026-10-28 03:49:30 UTC; 10 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"144.48.4.242","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-144-48-4-242"],"evidence":[{"id":"greynoise-event-144-48-4-242","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-24","organization":"EDGENAP LTD","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. EDGENAP LTD, AS61414, Japan. GreyNoise first_seen 2025-08-30; last seen 2026-10-24 20:18:42 UTC; 3 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"145.239.91.0","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-145-239-91-0"],"evidence":[{"id":"greynoise-event-145-239-91-0","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"OVH SAS","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. OVH SAS, AS16276, Poland. GreyNoise first_seen 2023-03-16; last seen 2026-10-26 14:34:42 UTC; 37 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"146.70.98.138","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-146-70-98-138"],"evidence":[{"id":"greynoise-event-146-70-98-138","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"M247 Europe SRL","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. M247 Europe SRL, AS9009, United States. GreyNoise first_seen 2026-06-11; last seen 2026-10-25 18:52:07 UTC; 6 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"146.70.117.243","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-146-70-117-243"],"evidence":[{"id":"greynoise-event-146-70-117-243","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"M247 Europe SRL","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. M247 Europe SRL, AS9009, Germany. GreyNoise first_seen 2023-05-30; last seen 2026-10-26 02:11:17 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"146.70.131.237","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-146-70-131-237"],"evidence":[{"id":"greynoise-source-146-70-131-237","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"M247 Europe SRL","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":2,"latestAlert":"2026-10-24T09:01:54Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: M247 Europe SRL. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 2; latest alert: 2026-10-24T09:01:54Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"146.70.184.216","sourceKeys":["ellio"],"aliases":["ellio-source-146-70-184-216"],"evidence":[{"id":"ellio-source-146-70-184-216","sourceKeys":["ellio"],"verification":"Referenced","date":"2026-10-21","checked":"2026-10-23","provenance":"ELLIO report figure: A day of PHP2Shell requests, address by address. Nine source addresses observed on 21 October 2026 (UTC).","context":"Find inbound requests from a source IP in ELLIO’s 21 October timeline.","limit":"The timeline includes probes and exploit-like requests; an IP match alone does not establish compromise.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"146.70.201.232","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-146-70-201-232"],"evidence":[{"id":"greynoise-event-146-70-201-232","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"M247 Europe SRL","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. M247 Europe SRL, AS9009, Japan. GreyNoise first_seen 2025-06-13; last seen 2026-10-22 22:43:01 UTC; 80 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"146.70.217.86","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-146-70-217-86"],"evidence":[{"id":"greynoise-event-146-70-217-86","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"M247 Europe SRL","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. M247 Europe SRL, AS9009, United States. GreyNoise first_seen 2024-08-26; last seen 2026-10-30 01:33:22 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"146.70.224.226","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-146-70-224-226"],"evidence":[{"id":"greynoise-event-146-70-224-226","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"M247 Europe SRL","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Request Memory Exhaustion. M247 Europe SRL, AS9009, Hong Kong. GreyNoise first_seen 2026-01-07; last seen 2026-10-25 11:42:28 UTC; 6 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"147.78.241.219","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-147-78-241-219"],"evidence":[{"id":"greynoise-event-147-78-241-219","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-27","organization":"Owl Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. Owl Limited, AS43357, Germany. GreyNoise first_seen 2026-08-13; last seen 2026-10-27 16:39:37 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"147.182.222.30","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-147-182-222-30","greynoise-event-147-182-222-30"],"evidence":[{"id":"greynoise-source-147-182-222-30","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"DigitalOcean, LLC","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:00:47Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: DigitalOcean, LLC. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-22T09:00:47Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-147-182-222-30","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"DigitalOcean, LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. DigitalOcean, LLC, AS14061, United States. GreyNoise first_seen 2026-10-22; last seen 2026-10-22 07:04:47 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"149.28.157.90","sourceKeys":["ellio","greynoise","greynoiseEvents"],"aliases":["ellio-source-149-28-157-90","greynoise-event-149-28-157-90"],"evidence":[{"id":"ellio-source-149-28-157-90","sourceKeys":["ellio"],"verification":"Referenced","date":"2026-10-21","checked":"2026-10-23","provenance":"ELLIO report figure: A day of PHP2Shell requests, address by address. Nine source addresses observed on 21 October 2026 (UTC).","context":"Find inbound requests from a source IP in ELLIO’s 21 October timeline.","limit":"The timeline includes probes and exploit-like requests; an IP match alone does not establish compromise.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]},{"id":"greynoise-event-149-28-157-90","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-21","organization":"The Constant Company, LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. The Constant Company, LLC, AS20473, Singapore. GreyNoise first_seen 2026-10-21; last seen 2026-10-21 23:12:16 UTC; 9 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"149.102.229.156","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-149-102-229-156"],"evidence":[{"id":"greynoise-event-149-102-229-156","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Datacamp Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Datacamp Limited, AS212238, Turkey. GreyNoise first_seen 2025-10-16; last seen 2026-10-22 11:55:17 UTC; 16 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"150.241.121.67","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-150-241-121-67"],"evidence":[{"id":"greynoise-event-150-241-121-67","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"Baxet Group Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Baxet Group Inc., AS26383, Czech Republic. GreyNoise first_seen 2026-10-28; last seen 2026-10-30 04:28:03 UTC; 10 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"151.241.171.87","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-151-241-171-87"],"evidence":[{"id":"greynoise-event-151-241-171-87","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"31173 Services AB","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. 31173 Services AB, AS39351, Germany. GreyNoise first_seen 2020-06-29; last seen 2026-10-26 00:30:10 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"152.42.195.115","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-152-42-195-115"],"evidence":[{"id":"greynoise-event-152-42-195-115","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"DigitalOcean, LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. DigitalOcean, LLC, AS14061, Singapore. GreyNoise first_seen 2026-03-06; last seen 2026-10-22 15:39:29 UTC; 124 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"152.53.193.96","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-152-53-193-96"],"evidence":[{"id":"greynoise-event-152-53-193-96","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"netcup GmbH","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Session Poisoning. netcup GmbH, AS214996, United States. GreyNoise first_seen 2026-09-12; last seen 2026-10-29 19:48:03 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"153.75.83.37","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-153-75-83-37"],"evidence":[{"id":"greynoise-event-153-75-83-37","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"RouterHosting LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. RouterHosting LLC, AS14956, United States. GreyNoise first_seen 2026-10-27; last seen 2026-10-28 11:52:10 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"154.26.182.240","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-154-26-182-240"],"evidence":[{"id":"greynoise-event-154-26-182-240","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"DMIT Cloud Services","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. DMIT Cloud Services, AS906, United States. GreyNoise first_seen 2025-12-12; last seen 2026-10-26 10:33:23 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"156.146.38.170","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-156-146-38-170"],"evidence":[{"id":"greynoise-event-156-146-38-170","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"Datacamp Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Request Memory Exhaustion, php2shell-Labeled Tooling. Datacamp Limited, AS60068, United States. GreyNoise first_seen 2024-12-06; last seen 2026-10-29 17:23:19 UTC; 18 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"156.225.28.97","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-156-225-28-97"],"evidence":[{"id":"greynoise-event-156-225-28-97","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"cognetcloud INC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. cognetcloud INC, AS401701, Hong Kong. GreyNoise first_seen 2026-10-10; last seen 2026-10-30 05:05:59 UTC; 92 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"157.245.110.32","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-157-245-110-32"],"evidence":[{"id":"greynoise-event-157-245-110-32","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"DigitalOcean, LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. DigitalOcean, LLC, AS14061, India. GreyNoise first_seen 2022-02-04; last seen 2026-10-23 13:33:22 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"159.26.109.92","sourceKeys":["previdian"],"aliases":["private-source-159-26-109-92"],"evidence":[{"id":"private-source-159-26-109-92","sourceKeys":["previdian"],"verification":"Unconfirmed","date":"2026-10-21","checked":"2026-10-23","firstSeen":"2026-10-21T21:28:31Z","lastSeen":"2026-10-21T21:28:39Z","observations":4,"provenance":"Supplied CVE-2026-109618-observations.json; Previdian. Not independently corroborated.","context":"Find requests from a source IP in the supplied Previdian observations.","limit":"Investigation lead, not a blocking recommendation.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json","role":"Related context only"}]}],"verification":"Unconfirmed"},{"indicator":"159.26.110.122","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-159-26-110-122"],"evidence":[{"id":"greynoise-event-159-26-110-122","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-27","organization":"Proton AG","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Proton AG, AS208172, Poland. GreyNoise first_seen 2025-11-26; last seen 2026-10-27 12:25:30 UTC; 7 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"159.26.110.129","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-159-26-110-129"],"evidence":[{"id":"greynoise-event-159-26-110-129","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-27","organization":"Proton AG","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Proton AG, AS208172, Poland. GreyNoise first_seen 2026-06-17; last seen 2026-10-27 10:01:15 UTC; 11 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"159.223.59.200","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-159-223-59-200","greynoise-event-159-223-59-200"],"evidence":[{"id":"greynoise-source-159-223-59-200","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"DigitalOcean, LLC","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:02:38Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: DigitalOcean, LLC. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-22T09:02:38Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-159-223-59-200","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"DigitalOcean, LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. DigitalOcean, LLC, AS14061, Singapore. GreyNoise first_seen 2022-09-30; last seen 2026-10-26 16:27:09 UTC; 260 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"161.132.37.162","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-161-132-37-162"],"evidence":[{"id":"greynoise-event-161-132-37-162","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Red Cientifica Peruana","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Red Cientifica Peruana, AS3132, Peru. GreyNoise first_seen 2026-09-20; last seen 2026-10-23 08:16:14 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"161.184.215.40","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-161-184-215-40"],"evidence":[{"id":"greynoise-event-161-184-215-40","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-26","organization":"TELUS Communications Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. TELUS Communications Inc., AS852, Canada. GreyNoise first_seen 2026-10-25; last seen 2026-10-26 11:23:10 UTC; 14 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"166.1.90.109","sourceKeys":["previdian"],"aliases":["private-source-166-1-90-109"],"evidence":[{"id":"private-source-166-1-90-109","sourceKeys":["previdian"],"verification":"Unconfirmed","date":"2026-10-21","checked":"2026-10-23","firstSeen":"2026-10-21T13:05:34Z","lastSeen":"2026-10-21T13:05:34Z","observations":1,"provenance":"Supplied CVE-2026-109618-observations.json; Previdian. Not independently corroborated.","context":"Find requests from a source IP in the supplied Previdian observations.","limit":"Investigation lead, not a blocking recommendation.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json","role":"Related context only"}]}],"verification":"Unconfirmed"},{"indicator":"167.17.47.102","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-167-17-47-102"],"evidence":[{"id":"greynoise-event-167-17-47-102","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"Trunk Networks LTD","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Trunk Networks LTD, AS43180, Singapore. GreyNoise first_seen 2026-10-24; last seen 2026-10-29 13:45:09 UTC; 12 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"167.233.52.2","sourceKeys":["previdian"],"aliases":["private-source-167-233-52-2"],"evidence":[{"id":"private-source-167-233-52-2","sourceKeys":["previdian"],"verification":"Unconfirmed","date":"2026-10-21","checked":"2026-10-23","firstSeen":"2026-10-21T21:18:06Z","lastSeen":"2026-10-21T22:05:18Z","observations":2,"provenance":"Supplied CVE-2026-109618-observations.json; Previdian. Not independently corroborated.","context":"Find requests from a source IP in the supplied Previdian observations.","limit":"Investigation lead, not a blocking recommendation.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json","role":"Related context only"}]}],"verification":"Unconfirmed"},{"indicator":"168.63.74.28","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-168-63-74-28"],"evidence":[{"id":"greynoise-source-168-63-74-28","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Microsoft Corporation","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-21T14:01:05Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Microsoft Corporation. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-21T14:01:05Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"169.150.227.213","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-169-150-227-213"],"evidence":[{"id":"greynoise-event-169-150-227-213","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-21","organization":"Datacamp Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. Datacamp Limited, AS212238, Israel. GreyNoise first_seen 2023-01-02; last seen 2026-10-21 22:41:07 UTC; 3 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"170.62.100.187","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-170-62-100-187"],"evidence":[{"id":"greynoise-event-170-62-100-187","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-27","organization":"Datacamp Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Datacamp Limited, AS212238, Sweden. GreyNoise first_seen 2025-09-29; last seen 2026-10-27 14:33:02 UTC; 5 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"170.62.100.237","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-170-62-100-237"],"evidence":[{"id":"greynoise-event-170-62-100-237","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"Datacamp Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Datacamp Limited, AS212238, Sweden. GreyNoise first_seen 2025-06-08; last seen 2026-10-25 05:27:22 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"170.187.190.236","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-170-187-190-236","greynoise-event-170-187-190-236"],"evidence":[{"id":"greynoise-source-170-187-190-236","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Akamai Connected Cloud","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":2,"latestAlert":"2026-10-23T09:01:30Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Akamai Connected Cloud. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 2; latest alert: 2026-10-23T09:01:30Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-170-187-190-236","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Akamai Connected Cloud","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Akamai Connected Cloud, AS63949, Germany. GreyNoise first_seen 2023-09-08; last seen 2026-10-23 11:10:55 UTC; 511 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"170.205.31.28","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-170-205-31-28"],"evidence":[{"id":"greynoise-event-170-205-31-28","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-24","organization":"Advin Services LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Advin Services LLC, AS206216, United States. GreyNoise first_seen 2026-09-22; last seen 2026-10-24 11:07:34 UTC; 4 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"172.166.165.148","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-172-166-165-148","greynoise-event-172-166-165-148"],"evidence":[{"id":"greynoise-source-172-166-165-148","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Microsoft Corporation","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:02:38Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Microsoft Corporation. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-22T09:02:38Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-172-166-165-148","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Microsoft Corporation","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Microsoft Corporation, AS8075, United Kingdom. GreyNoise first_seen 2026-10-21; last seen 2026-10-22 10:17:58 UTC; 223 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"175.117.45.36","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-175-117-45-36"],"evidence":[{"id":"greynoise-event-175-117-45-36","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"SK Broadband Co Ltd","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. SK Broadband Co Ltd, AS9318, South Korea. GreyNoise first_seen 2026-10-29; last seen 2026-10-29 13:02:46 UTC; 13 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"176.4.191.221","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-176-4-191-221"],"evidence":[{"id":"greynoise-event-176-4-191-221","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Telefonica Germany GmbH & Co.OHG","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Telefonica Germany GmbH & Co.OHG, AS6805, Germany. GreyNoise first_seen 2026-10-23; last seen 2026-10-23 18:41:26 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"176.65.132.128","sourceKeys":["ellio"],"aliases":["ellio-source-176-65-132-128"],"evidence":[{"id":"ellio-source-176-65-132-128","sourceKeys":["ellio"],"verification":"Referenced","date":"2026-10-21","checked":"2026-10-23","provenance":"ELLIO report figure: A day of PHP2Shell requests, address by address. Nine source addresses observed on 21 October 2026 (UTC).","context":"Find inbound requests from a source IP in ELLIO’s 21 October timeline.","limit":"The timeline includes probes and exploit-like requests; an IP match alone does not establish compromise.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"176.65.139.168","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-176-65-139-168"],"evidence":[{"id":"greynoise-event-176-65-139-168","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-27","organization":"Storm Industries LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Memory Corruption Exploit, Request Memory Exhaustion. Storm Industries LLC, AS219502, Germany. GreyNoise first_seen 2026-05-02; last seen 2026-10-27 18:54:41 UTC; 223 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"176.124.32.170","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-176-124-32-170"],"evidence":[{"id":"greynoise-event-176-124-32-170","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"BlueVPS OU","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Session Poisoning, php2shell-Labeled Tooling. BlueVPS OU, AS62005, Estonia. GreyNoise first_seen 2026-10-23; last seen 2026-10-25 17:21:28 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"178.104.167.156","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-178-104-167-156"],"evidence":[{"id":"greynoise-event-178-104-167-156","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Hetzner Online GmbH","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Hetzner Online GmbH, AS24940, Germany. GreyNoise first_seen 2026-10-21; last seen 2026-10-22 22:58:01 UTC; 174 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"178.249.209.166","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-178-249-209-166"],"evidence":[{"id":"greynoise-event-178-249-209-166","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"Datacamp Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Datacamp Limited, AS212238, Czech Republic. GreyNoise first_seen 2025-10-13; last seen 2026-10-29 21:46:03 UTC; 28 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"178.249.214.6","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-178-249-214-6"],"evidence":[{"id":"greynoise-event-178-249-214-6","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-24","organization":"Datacamp Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Datacamp Limited, AS212238, Canada. GreyNoise first_seen 2020-03-11; last seen 2026-10-24 01:20:00 UTC; 11 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"182.2.177.82","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-182-2-177-82"],"evidence":[{"id":"greynoise-event-182-2-177-82","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"PT. Telekomunikasi Selular","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. PT. Telekomunikasi Selular, AS23693, Indonesia. GreyNoise first_seen 2026-01-17; last seen 2026-10-25 06:19:38 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"182.2.182.165","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-182-2-182-165"],"evidence":[{"id":"greynoise-event-182-2-182-165","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"PT. Telekomunikasi Selular","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. PT. Telekomunikasi Selular, AS23693, Indonesia. GreyNoise first_seen 2020-03-18; last seen 2026-10-25 07:45:51 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"182.2.190.142","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-182-2-190-142"],"evidence":[{"id":"greynoise-event-182-2-190-142","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"PT. Telekomunikasi Selular","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. PT. Telekomunikasi Selular, AS23693, Indonesia. GreyNoise first_seen 2026-10-20; last seen 2026-10-25 05:37:49 UTC; 3 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"183.241.192.249","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-183-241-192-249"],"evidence":[{"id":"greynoise-event-183-241-192-249","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"China Mobile Communicaitons Corporation","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. China Mobile Communicaitons Corporation, AS56048, China. GreyNoise first_seen 2026-10-21; last seen 2026-10-22 01:06:32 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"184.73.151.236","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-184-73-151-236"],"evidence":[{"id":"greynoise-event-184-73-151-236","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Amazon.com, Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Amazon.com, Inc., AS14618, United States. GreyNoise first_seen 2026-10-22; last seen 2026-10-22 04:34:48 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"185.65.134.250","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-185-65-134-250"],"evidence":[{"id":"greynoise-event-185-65-134-250","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"31173 Services AB","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. GreyNoise confirmed 186 exploitation sessions from this source on 29 October 2026, followed by a reverse shell to 206.245.153.56:42104 and host collection. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. 31173 Services AB, AS39351, Netherlands. GreyNoise first_seen 2023-05-30; last seen 2026-10-30 04:47:53 UTC; 10 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a source GreyNoise confirmed executing commands on a vulnerable sensor.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"185.65.135.250","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-185-65-135-250"],"evidence":[{"id":"greynoise-event-185-65-135-250","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-27","organization":"31173 Services AB","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. 31173 Services AB, AS39351, Sweden. GreyNoise first_seen 2025-10-31; last seen 2026-10-27 11:56:54 UTC; 12 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"185.130.45.226","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-185-130-45-226"],"evidence":[{"id":"greynoise-event-185-130-45-226","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Privex Inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion. Privex Inc., AS210083, Sweden. GreyNoise first_seen 2026-06-17; last seen 2026-10-23 12:36:03 UTC; 3 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"185.131.54.148","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-185-131-54-148"],"evidence":[{"id":"greynoise-event-185-131-54-148","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"Tier 4 Cloud Services","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Tier 4 Cloud Services, AS146943, India. GreyNoise first_seen 2026-10-28; last seen 2026-10-28 00:11:49 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"185.177.72.45","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-185-177-72-45","greynoise-event-185-177-72-45"],"evidence":[{"id":"greynoise-source-185-177-72-45","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Bucklog SARL","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":2,"latestAlert":"2026-10-23T09:01:30Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Bucklog SARL. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 2; latest alert: 2026-10-23T09:01:30Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-185-177-72-45","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Bucklog SARL","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Bucklog SARL, AS211590, France. GreyNoise first_seen 2025-08-03; last seen 2026-10-23 09:08:42 UTC; 146 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"185.207.232.121","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-185-207-232-121","greynoise-event-185-207-232-121"],"evidence":[{"id":"greynoise-source-185-207-232-121","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"KOMAX OOD","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":2,"latestAlert":"2026-10-23T09:01:30Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: KOMAX OOD. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 2; latest alert: 2026-10-23T09:01:30Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-185-207-232-121","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"KOMAX OOD","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. KOMAX OOD, AS41366, Bulgaria. GreyNoise first_seen 2026-10-21; last seen 2026-10-25 22:12:21 UTC; 1260 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"185.213.154.179","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-185-213-154-179"],"evidence":[{"id":"greynoise-event-185-213-154-179","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"31173 Services AB","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. 31173 Services AB, AS39351, Sweden. GreyNoise first_seen 2023-07-02; last seen 2026-10-25 05:49:07 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"185.225.191.232","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-185-225-191-232"],"evidence":[{"id":"greynoise-event-185-225-191-232","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"MEVSPACE sp. z o.o.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, Session Poisoning, php2shell-Labeled Tooling. MEVSPACE sp. z o.o., AS201814, Poland. GreyNoise first_seen 2026-10-20; last seen 2026-10-25 15:04:13 UTC; 381 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"185.252.220.147","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-185-252-220-147"],"evidence":[{"id":"greynoise-event-185-252-220-147","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"M247 Europe SRL","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. M247 Europe SRL, AS9009, Romania. GreyNoise first_seen 2025-10-10; last seen 2026-10-23 14:52:48 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"186.22.19.172","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-186-22-19-172"],"evidence":[{"id":"greynoise-event-186-22-19-172","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"Telecentro S.A.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Telecentro S.A., AS27747, Argentina. GreyNoise first_seen 2023-11-18; last seen 2026-10-25 01:21:29 UTC; 3 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"188.166.166.205","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-188-166-166-205","greynoise-event-188-166-166-205"],"evidence":[{"id":"greynoise-source-188-166-166-205","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"DigitalOcean, LLC","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":2,"latestAlert":"2026-10-23T09:01:30Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: DigitalOcean, LLC. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 2; latest alert: 2026-10-23T09:01:30Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-188-166-166-205","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"DigitalOcean, LLC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. DigitalOcean, LLC, AS14061, Germany. GreyNoise first_seen 2026-10-12; last seen 2026-10-29 22:14:00 UTC; 6653 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"191.217.250.227","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-191-217-250-227"],"evidence":[{"id":"greynoise-event-191-217-250-227","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"Samuel Dierich","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Samuel Dierich, AS218877, Netherlands. GreyNoise first_seen 2026-10-25; last seen 2026-10-29 18:08:10 UTC; 323 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"192.9.168.47","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-192-9-168-47"],"evidence":[{"id":"greynoise-event-192-9-168-47","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"Oracle Corporation","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Oracle Corporation, AS31898, Australia. GreyNoise first_seen 2026-04-01; last seen 2026-10-30 06:03:22 UTC; 3914 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"192.42.116.100","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-192-42-116-100"],"evidence":[{"id":"greynoise-source-192-42-116-100","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Church of Cyberology","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:02:38Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Church of Cyberology. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-22T09:02:38Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"192.140.154.1","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-192-140-154-1"],"evidence":[{"id":"greynoise-event-192-140-154-1","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Excitel Broadband Private Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. Excitel Broadband Private Limited, AS133982, India. GreyNoise first_seen 2026-01-06; last seen 2026-10-22 06:05:18 UTC; 3 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"192.169.119.217","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-192-169-119-217"],"evidence":[{"id":"greynoise-event-192-169-119-217","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-24","organization":"Zenlayer Inc","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Zenlayer Inc, AS21859, Taiwan. GreyNoise first_seen 2026-09-06; last seen 2026-10-24 04:38:50 UTC; 4 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"192.253.209.123","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-192-253-209-123"],"evidence":[{"id":"greynoise-event-192-253-209-123","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"GSL Networks Pty LTD","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. GSL Networks Pty LTD, AS137409, United States. GreyNoise first_seen 2025-03-28; last seen 2026-10-28 15:10:45 UTC; 66 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"193.29.106.28","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-193-29-106-28"],"evidence":[{"id":"greynoise-event-193-29-106-28","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-27","organization":"M247 Europe SRL","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. M247 Europe SRL, AS9009, Germany. GreyNoise first_seen 2021-03-03; last seen 2026-10-27 10:08:44 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"193.32.249.238","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-193-32-249-238"],"evidence":[{"id":"greynoise-event-193-32-249-238","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"31173 Services AB","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. 31173 Services AB, AS39351, Netherlands. GreyNoise first_seen 2025-03-26; last seen 2026-10-29 19:48:42 UTC; 19 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"193.47.62.24","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-193-47-62-24"],"evidence":[{"id":"greynoise-event-193-47-62-24","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"BestDC Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. BestDC Limited, AS216014, Netherlands. GreyNoise first_seen 2019-06-11; last seen 2026-10-29 06:34:25 UTC; 31 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"194.42.196.44","sourceKeys":["offseq"],"aliases":["offseq-source-194-42-196-44"],"evidence":[{"id":"offseq-source-194-42-196-44","sourceKeys":["offseq"],"verification":"Referenced","date":"2026-10-20 / 2026-10-22","checked":"2026-10-23","provenance":"OffSeq first-48-hours report: upload-progress requests, probes or memory-pressure bodies on low-interaction sensors; not demonstrated compromise.","context":"Find requests from OffSeq-reported probe and attempt sources. Some memory-pressure traffic was classified by request shape.","limit":"Investigation lead; shared infrastructure and fingerprints can overlap benign traffic.","references":[{"label":"OffSeq — first 48 hours","url":"https://offseq.com/en/research/php2shell-first-48-hours/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"194.156.238.177","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-194-156-238-177"],"evidence":[{"id":"greynoise-event-194-156-238-177","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-24","organization":"TBTNET TELEKOM LTD. STI.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. TBTNET TELEKOM LTD. STI., AS206163, Turkey. GreyNoise first_seen 2026-10-24; last seen 2026-10-24 21:29:21 UTC; 5 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"195.88.87.101","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-195-88-87-101","greynoise-event-195-88-87-101"],"evidence":[{"id":"greynoise-source-195-88-87-101","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Contabo GmbH","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:00:47Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Contabo GmbH. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-22T09:00:47Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-195-88-87-101","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Contabo GmbH","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Contabo GmbH, AS51167, France. GreyNoise first_seen 2026-09-27; last seen 2026-10-22 08:26:53 UTC; 3 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"198.44.159.163","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-198-44-159-163"],"evidence":[{"id":"greynoise-event-198-44-159-163","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"tzulo, inc.","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. tzulo, inc., AS11878, United States. GreyNoise first_seen 2026-10-19; last seen 2026-10-29 18:38:59 UTC; 4 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"198.200.59.85","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-198-200-59-85"],"evidence":[{"id":"greynoise-event-198-200-59-85","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"PEG TECH INC","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. PEG TECH INC, AS54600, United States. GreyNoise first_seen 2026-09-29; last seen 2026-10-22 14:07:56 UTC; 29 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"200.119.44.50","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-200-119-44-50"],"evidence":[{"id":"greynoise-event-200-119-44-50","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"ETB - Colombia","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Session Poisoning. ETB - Colombia, AS19429, Colombia. GreyNoise first_seen 2024-07-29; last seen 2026-10-22 21:51:17 UTC; 259 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"200.141.3.58","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-200-141-3-58"],"evidence":[{"id":"greynoise-event-200-141-3-58","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Hostinger International Limited","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Hostinger International Limited, AS47583, India. GreyNoise first_seen 2026-10-21; last seen 2026-10-23 21:19:00 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"203.189.139.225","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-203-189-139-225"],"evidence":[{"id":"greynoise-event-203-189-139-225","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-22","organization":"Cogetel Online, Cambodia, ISP","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Session Poisoning. Cogetel Online, Cambodia, ISP, AS23673, Cambodia. GreyNoise first_seen 2023-01-31; last seen 2026-10-22 13:32:53 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"204.76.203.237","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-204-76-203-237"],"evidence":[{"id":"greynoise-event-204-76-203-237","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-30","organization":"Pfcloud UG","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Session Poisoning, php2shell-Labeled Tooling. Pfcloud UG, AS51396, Netherlands. GreyNoise first_seen 2022-11-21; last seen 2026-10-30 01:36:58 UTC; 6593 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"206.71.169.144","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-206-71-169-144"],"evidence":[{"id":"greynoise-event-206-71-169-144","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"M5 Computer Security","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. M5 Computer Security, AS21581, United States. GreyNoise first_seen 2025-12-05; last seen 2026-10-23 21:55:12 UTC; 3 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"212.30.206.158","sourceKeys":["greynoise","greynoiseCsv","greynoiseEvents"],"aliases":["greynoise-source-212-30-206-158","greynoise-event-212-30-206-158"],"evidence":[{"id":"greynoise-source-212-30-206-158","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Mila hf","reportedCVEs":["CVE-2026-109619"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:02:38Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Mila hf. Associated CVEs: CVE-2026-109619. Alert occurrences: 1; latest alert: 2026-10-22T09:02:38Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]},{"id":"greynoise-event-212-30-206-158","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-27","organization":"Mila hf","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning, php2shell-Labeled Tooling. Mila hf, AS6677, Iceland. GreyNoise first_seen 2026-10-21; last seen 2026-10-27 11:53:59 UTC; 306 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"212.95.52.99","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-212-95-52-99"],"evidence":[{"id":"greynoise-event-212-95-52-99","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-28","organization":"Leaseweb Deutschland GmbH","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Leaseweb Deutschland GmbH, AS28753, Germany. GreyNoise first_seen 2025-10-21; last seen 2026-10-28 01:57:00 UTC; 4 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"217.60.196.124","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-217-60-196-124"],"evidence":[{"id":"greynoise-event-217-60-196-124","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","organization":"OVH SAS","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Session Poisoning. OVH SAS, AS16276, Germany. GreyNoise first_seen 2019-10-11; last seen 2026-10-29 02:05:21 UTC; 169 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"217.60.242.58","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-217-60-242-58"],"evidence":[{"id":"greynoise-source-217-60-242-58","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"Amin NezhadKahnoji","reportedCVEs":["CVE-2026-109618"],"alertOccurrences":1,"latestAlert":"2026-10-22T09:00:47Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: Amin NezhadKahnoji. Associated CVEs: CVE-2026-109618. Alert occurrences: 1; latest alert: 2026-10-22T09:00:47Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"217.60.242.76","sourceKeys":["ellio","offseq","previdian"],"aliases":["ellio-source-217-60-242-76","offseq-source-217-60-242-76","private-source-217-60-242-76"],"evidence":[{"id":"ellio-source-217-60-242-76","sourceKeys":["ellio"],"verification":"Referenced","date":"2026-10-21","checked":"2026-10-23","provenance":"ELLIO report figure: A day of PHP2Shell requests, address by address. Nine source addresses observed on 21 October 2026 (UTC).","context":"Find inbound requests from a source IP in ELLIO’s 21 October timeline.","limit":"The timeline includes probes and exploit-like requests; an IP match alone does not establish compromise.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]},{"id":"offseq-source-217-60-242-76","sourceKeys":["offseq"],"verification":"Referenced","date":"2026-10-20 / 2026-10-22","checked":"2026-10-23","provenance":"OffSeq first-48-hours report: upload-progress requests, probes or memory-pressure bodies on low-interaction sensors; not demonstrated compromise.","context":"Find requests from OffSeq-reported probe and attempt sources. Some memory-pressure traffic was classified by request shape.","limit":"Investigation lead; shared infrastructure and fingerprints can overlap benign traffic.","references":[{"label":"OffSeq — first 48 hours","url":"https://offseq.com/en/research/php2shell-first-48-hours/","role":"Supporting reference"}]},{"id":"private-source-217-60-242-76","sourceKeys":["previdian"],"verification":"Unconfirmed","date":"2026-10-21","checked":"2026-10-23","firstSeen":"2026-10-21T20:40:27Z","lastSeen":"2026-10-21T21:11:25Z","observations":10,"provenance":"Supplied CVE-2026-109618-observations.json; Previdian. Not independently corroborated.","context":"Find requests from a source IP in the supplied Previdian observations.","limit":"Investigation lead, not a blocking recommendation.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json","role":"Related context only"}]}],"verification":"Mixed — see per-source evidence"},{"indicator":"220.158.233.62","sourceKeys":["greynoise","greynoiseCsv"],"aliases":["greynoise-source-220-158-233-62"],"evidence":[{"id":"greynoise-source-220-158-233-62","sourceKeys":["greynoise","greynoiseCsv"],"verification":"Referenced","date":null,"checked":"2026-10-25","organization":"ISP/IXP IN CAMBODIA WITH THE BEST VERVICE IN THERE.","reportedCVEs":["CVE-2026-109618","CVE-2026-109619"],"alertOccurrences":2,"latestAlert":"2026-10-24T09:01:54Z","provenance":"GreyNoise credit; retrieved from the SlimKQL-hosted CSV. Organization: ISP/IXP IN CAMBODIA WITH THE BEST VERVICE IN THERE.. Associated CVEs: CVE-2026-109618, CVE-2026-109619. Alert occurrences: 2; latest alert: 2026-10-24T09:01:54Z. These are upstream alert metadata, not local request counts or verified first/last attack times.","context":"Find requests from an address in the supplied GreyNoise-attributed PHP2Shell attacker-IP list.","limit":"CSV provenance is a third-party mirror, not an independent GreyNoise API lookup. Shared/reassigned infrastructure and scanner activity limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise-attributed PHP2Shell IP list — SlimKQL mirror","url":"https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/greynoise_php2shell_attacker_ips.csv","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"221.14.159.134","sourceKeys":["vulncheck"],"aliases":["reported-26"],"evidence":[{"id":"reported-26","sourceKeys":["vulncheck"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Network / Timeline.","context":"Source observed in scanning, probing or exploitation-attempt traffic.","limit":"Shared or reassigned addresses reduce attribution value.","references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"223.178.86.187","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-223-178-86-187"],"evidence":[{"id":"greynoise-event-223-178-86-187","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Bharti Airtel Ltd., Telemedia Services","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, Request Memory Exhaustion, php2shell-Labeled Tooling. Bharti Airtel Ltd., Telemedia Services, AS24560, India. GreyNoise first_seen 2022-06-30; last seen 2026-10-23 17:59:50 UTC; 1 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"223.181.62.146","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-223-181-62-146"],"evidence":[{"id":"greynoise-event-223-181-62-146","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-23","organization":"Bharti Airtel Ltd., Telemedia Services","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Bharti Airtel Ltd., Telemedia Services, AS24560, India. GreyNoise first_seen 2025-08-01; last seen 2026-10-23 10:40:08 UTC; 2 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"223.252.16.151","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-223-252-16-151"],"evidence":[{"id":"greynoise-event-223-252-16-151","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-25","organization":"Wholesale Services Provider","provenance":"GreyNoise PHP2SHELL event-page block candidate, snapshot 30 October 2026. Classification: malicious. Tags: Activity, Memory Corruption Exploit, php2shell-Labeled Tooling. Wholesale Services Provider, AS45671, Australia. GreyNoise first_seen 2026-09-16; last seen 2026-10-25 10:42:44 UTC; 3 sensor(s). first_seen is global to the address, not to this campaign.","context":"Find requests from a GreyNoise block-candidate PHP2Shell source.","limit":"Snapshot of a live, changing page. Hosting, VPN and reassigned addresses limit attribution; an IP match does not prove a PHP2Shell attempt or compromise.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"}],"aliases":["reported-1","ips-aws-ip-referenced","reported-2","reported-3","reported-4","reported-5","reported-6","reported-23","ips-vulncheck-ip-referenced","reported-24","reported-25","reported-26","reported-27","ellio-source-85-11-167-243","ips-ellio-ip-referenced","ellio-source-45-198-224-169","ellio-source-94-154-43-7","ellio-source-36-162-178-158","ellio-source-146-70-184-216","ellio-source-217-60-242-76","ellio-source-176-65-132-128","ellio-source-13-201-109-35","ellio-source-149-28-157-90","offseq-source-94-154-43-7","ips-offseq-ip-referenced","offseq-source-38-180-45-91","offseq-source-80-66-66-66","offseq-source-217-60-242-76","offseq-source-87-192-237-19","offseq-source-34-19-34-88","offseq-source-34-76-232-95","offseq-source-34-76-218-47","offseq-source-194-42-196-44","greynoise-source-5-255-114-109","ips-greynoise-greynoisecsv-ip-referenced","greynoise-source-102-210-149-166","greynoise-source-18-237-26-182","greynoise-source-34-222-146-226","greynoise-source-54-149-222-88","greynoise-source-66-116-196-142","greynoise-source-81-28-4-17","greynoise-source-85-11-167-243","greynoise-source-95-216-5-90","greynoise-source-146-70-131-237","greynoise-source-170-187-190-236","greynoise-source-185-177-72-45","greynoise-source-185-207-232-121","greynoise-source-188-166-166-205","greynoise-source-220-158-233-62","greynoise-source-45-141-233-9","greynoise-source-45-61-178-105","greynoise-source-85-11-190-112","greynoise-source-94-154-43-7","greynoise-source-102-207-250-188","greynoise-source-103-131-131-168","greynoise-source-103-204-193-27","greynoise-source-104-28-233-170","greynoise-source-129-153-133-23","greynoise-source-141-94-33-148","greynoise-source-147-182-222-30","greynoise-source-159-223-59-200","greynoise-source-168-63-74-28","greynoise-source-172-166-165-148","greynoise-source-192-42-116-100","greynoise-source-195-88-87-101","greynoise-source-20-200-234-181","greynoise-source-20-238-86-17","greynoise-source-212-30-206-158","greynoise-source-217-60-242-58","greynoise-source-23-100-50-44","greynoise-source-23-106-131-214","greynoise-source-34-136-122-211","greynoise-source-37-27-209-157","greynoise-source-45-136-71-89","greynoise-source-45-148-10-201","greynoise-source-45-148-10-80","greynoise-source-45-156-129-57","greynoise-source-46-166-168-18","greynoise-source-52-17-252-187","greynoise-source-52-172-142-28","greynoise-source-64-111-92-102","greynoise-source-74-208-16-253","greynoise-source-74-208-167-97","greynoise-source-74-208-79-255","greynoise-source-77-90-185-20","greynoise-source-88-216-36-31","greynoise-source-94-154-43-222","greynoise-source-98-80-11-91","greynoise-event-2-59-133-151","ips-greynoise-greynoiseevents-ip-referenced","greynoise-event-3-68-250-21","greynoise-event-5-34-220-134","greynoise-event-5-104-86-24","greynoise-event-5-112-76-18","greynoise-event-5-161-255-209","greynoise-event-5-181-181-168","greynoise-event-5-189-160-29","greynoise-event-5-189-184-114","greynoise-event-5-231-118-119","greynoise-event-5-255-114-109","greynoise-event-13-201-109-35","greynoise-event-13-216-152-122","greynoise-event-14-120-124-27","greynoise-event-18-234-199-237","greynoise-event-20-24-237-207","greynoise-event-20-87-120-146","greynoise-event-20-200-234-181","greynoise-event-20-204-147-74","greynoise-event-23-26-237-221","greynoise-event-23-106-131-214","greynoise-event-23-165-56-186","greynoise-event-23-234-113-169","greynoise-event-23-234-117-66","greynoise-event-23-238-31-189","greynoise-event-27-100-38-10","greynoise-event-31-182-51-55","greynoise-event-34-136-122-211","greynoise-event-35-154-84-153","greynoise-event-37-19-198-236","greynoise-event-37-27-209-157","greynoise-event-38-60-206-217","greynoise-event-38-180-45-91","greynoise-event-38-180-230-11","greynoise-event-38-180-230-216","greynoise-event-43-173-9-190","greynoise-event-45-78-14-116","greynoise-event-45-115-26-26","greynoise-event-45-130-200-101","greynoise-event-45-136-71-89","greynoise-event-45-148-10-80","greynoise-event-45-148-10-201","greynoise-event-45-156-87-44","greynoise-event-45-198-224-169","greynoise-event-46-7-145-54","greynoise-event-46-37-123-14","greynoise-event-46-101-229-142","greynoise-event-46-205-208-16","greynoise-event-47-250-155-133","greynoise-event-51-83-187-123","greynoise-event-51-143-62-244","greynoise-event-52-17-252-187","greynoise-event-52-53-131-214","greynoise-event-52-53-211-104","greynoise-event-52-250-54-233","greynoise-event-54-154-150-2","greynoise-event-57-129-80-197","greynoise-event-63-186-150-111","greynoise-event-64-111-92-102","greynoise-event-64-227-149-251","greynoise-event-67-205-129-138","greynoise-event-72-251-215-19","greynoise-event-74-208-242-33","greynoise-event-75-119-143-189","greynoise-event-77-90-185-20","greynoise-event-77-91-113-125","greynoise-event-77-239-124-121","greynoise-event-77-243-184-207","greynoise-event-78-47-85-99","greynoise-event-79-110-49-21","greynoise-event-79-193-197-168","greynoise-event-81-28-4-17","greynoise-event-82-221-101-119","greynoise-event-83-21-173-138","greynoise-event-83-147-13-219","greynoise-event-85-11-167-243","greynoise-event-85-11-190-112","greynoise-event-85-199-255-137","greynoise-event-89-37-63-57","greynoise-event-89-37-63-146","greynoise-event-89-37-63-204","greynoise-event-89-37-63-248","greynoise-event-89-125-59-156","greynoise-event-90-155-6-87","greynoise-event-92-51-2-85","greynoise-event-92-88-170-153","greynoise-event-94-130-216-171","greynoise-event-94-154-43-7","greynoise-event-94-154-43-100","greynoise-event-94-154-43-149","greynoise-event-94-154-43-185","greynoise-event-94-154-43-187","greynoise-event-94-154-43-189","greynoise-event-95-139-123-158","greynoise-event-95-216-5-90","greynoise-event-95-217-164-124","greynoise-event-98-80-11-91","greynoise-event-98-98-47-154","greynoise-event-101-36-114-102","greynoise-event-101-128-110-145","greynoise-event-102-207-250-188","greynoise-event-103-149-183-197","greynoise-event-103-151-172-95","greynoise-event-103-204-193-27","greynoise-event-104-28-221-228","greynoise-event-104-243-29-169","greynoise-event-105-156-180-134","greynoise-event-109-120-147-103","greynoise-event-112-66-197-171","greynoise-event-112-66-198-12","greynoise-event-114-26-103-72","greynoise-event-116-251-216-106","greynoise-event-116-251-216-117","greynoise-event-119-59-101-74","greynoise-event-121-127-33-74","greynoise-event-123-25-115-82","greynoise-event-129-153-133-23","greynoise-event-130-12-180-42","greynoise-event-134-209-252-157","greynoise-event-138-199-43-94","greynoise-event-141-98-255-191","greynoise-event-141-98-255-246","greynoise-event-143-246-213-138","greynoise-event-144-31-90-126","greynoise-event-144-48-4-242","greynoise-event-145-239-91-0","greynoise-event-146-70-98-138","greynoise-event-146-70-117-243","greynoise-event-146-70-201-232","greynoise-event-146-70-217-86","greynoise-event-146-70-224-226","greynoise-event-147-78-241-219","greynoise-event-147-182-222-30","greynoise-event-149-28-157-90","greynoise-event-149-102-229-156","greynoise-event-150-241-121-67","greynoise-event-151-241-171-87","greynoise-event-152-42-195-115","greynoise-event-152-53-193-96","greynoise-event-153-75-83-37","greynoise-event-154-26-182-240","greynoise-event-156-146-38-170","greynoise-event-156-225-28-97","greynoise-event-157-245-110-32","greynoise-event-159-26-110-122","greynoise-event-159-26-110-129","greynoise-event-159-223-59-200","greynoise-event-161-132-37-162","greynoise-event-161-184-215-40","greynoise-event-167-17-47-102","greynoise-event-169-150-227-213","greynoise-event-170-62-100-187","greynoise-event-170-62-100-237","greynoise-event-170-187-190-236","greynoise-event-170-205-31-28","greynoise-event-172-166-165-148","greynoise-event-175-117-45-36","greynoise-event-176-4-191-221","greynoise-event-176-65-139-168","greynoise-event-176-124-32-170","greynoise-event-178-104-167-156","greynoise-event-178-249-209-166","greynoise-event-178-249-214-6","greynoise-event-182-2-177-82","greynoise-event-182-2-182-165","greynoise-event-182-2-190-142","greynoise-event-183-241-192-249","greynoise-event-184-73-151-236","greynoise-event-185-65-134-250","greynoise-event-185-65-135-250","greynoise-event-185-130-45-226","greynoise-event-185-131-54-148","greynoise-event-185-177-72-45","greynoise-event-185-207-232-121","greynoise-event-185-213-154-179","greynoise-event-185-225-191-232","greynoise-event-185-252-220-147","greynoise-event-186-22-19-172","greynoise-event-188-166-166-205","greynoise-event-191-217-250-227","greynoise-event-192-9-168-47","greynoise-event-192-140-154-1","greynoise-event-192-169-119-217","greynoise-event-192-253-209-123","greynoise-event-193-29-106-28","greynoise-event-193-32-249-238","greynoise-event-193-47-62-24","greynoise-event-194-156-238-177","greynoise-event-195-88-87-101","greynoise-event-198-44-159-163","greynoise-event-198-200-59-85","greynoise-event-200-119-44-50","greynoise-event-200-141-3-58","greynoise-event-203-189-139-225","greynoise-event-204-76-203-237","greynoise-event-206-71-169-144","greynoise-event-212-30-206-158","greynoise-event-212-95-52-99","greynoise-event-217-60-196-124","greynoise-event-223-178-86-187","greynoise-event-223-181-62-146","greynoise-event-223-252-16-151","private-source-38-180-230-216","ips-previdian-ip-unconfirmed","ips-private-source-ip-unconfirmed","private-source-78-47-85-99","private-source-141-94-33-148","private-source-89-125-59-156","private-source-31-133-50-90","private-source-38-180-230-11","private-source-167-233-52-2","private-source-159-26-109-92","private-source-217-60-242-76","private-source-27-34-69-235","private-source-120-235-218-21","private-source-43-134-82-85","private-source-166-1-90-109","hunt-cisa-arctic-ip","ips-arcticwolf-cisa-cisasigma-ip-referenced","previdian-20261028-source","ips-previdianresearch-ip-referenced"]}
---
title: "PHP2Shell - Payload download URLs (4)"
id: 0b47041e-99b7-52a6-8b75-fe4177cd30c7
name: php2shell_catalog_payload_urls
status: experimental
author: "CISA (cisa.gov), Sierra Echo Charlie (adaptation; per-member sources retained)"
description: "Find exact outbound payload URLs from the referenced reports."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[URL_FIELD]|cased":
      - "http://45.115.26.26:8000/cCmono"
      - "http://92.118.112.100/mountpoint"
      - "http://92.118.112.100/nfs"
      - "http://92.118.112.100/nfs-setup"
  condition: selection_1
falsepositives:
  - "Exact URL alternatives preserve scheme, port, path and case. Alternate encodings and URLs require separate coverage. The cCmono chain is not established as exploitation of either CVE."
level: low
references:
    - "https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
    - "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"payload-urls","group":"Payload infrastructure","cve_context":"CVE-2026-109618 / CVE-2026-109619 · campaign context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Exact URL alternatives preserve scheme, port, path and case. Alternate encodings and URLs require separate coverage. The cCmono chain is not established as exploitation of either CVE.","provenance":"Grouped by evidence type and byte scope. Each member retains its matching predicate, source observations and limitations.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"},{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"},{"label":"Arctic Wolf PHP2Shell observations","url":"https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"}],"members":[{"indicator":"http://45.115.26.26:8000/cCmono","field":"[URL_FIELD]","matchKind":"url","sourceKeys":["cisa","cisaSigma","arcticWolf"],"aliases":["cisa-url-2","cisa-payload-urls"],"evidence":[{"id":"cisa-url-2","sourceKeys":["cisa","cisaSigma","arcticWolf"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"Additional URLs from the current Arctic Wolf reference; the existing /nfs URL is retained separately.","context":"Find outbound requests for the additional payload URLs in Arctic Wolf’s report referenced by CISA.","limit":"Exact full outbound URLs; alternate schemes, ports, paths and encodings need separate searches. The cCmono request used a session-poisoning/deserialization chain and does not establish exploitation of either CVE; Arctic Wolf could not retrieve that payload.","condition":{"field":"[URL_FIELD]","op":"eq","value":"http://45.115.26.26:8000/cCmono"},"references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"Arctic Wolf PHP2Shell observations","url":"https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"http://92.118.112.100/mountpoint","field":"[URL_FIELD]","matchKind":"url","sourceKeys":["cisa","cisaSigma","arcticWolf"],"aliases":["cisa-url-1","cisa-payload-urls"],"evidence":[{"id":"cisa-url-1","sourceKeys":["cisa","cisaSigma","arcticWolf"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"Additional URLs from the current Arctic Wolf reference; the existing /nfs URL is retained separately.","context":"Find outbound requests for the additional payload URLs in Arctic Wolf’s report referenced by CISA.","limit":"Exact full outbound URLs; alternate schemes, ports, paths and encodings need separate searches. The cCmono request used a session-poisoning/deserialization chain and does not establish exploitation of either CVE; Arctic Wolf could not retrieve that payload.","condition":{"field":"[URL_FIELD]","op":"eq","value":"http://92.118.112.100/mountpoint"},"references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"Arctic Wolf PHP2Shell observations","url":"https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"http://92.118.112.100/nfs","field":"[URL_FIELD]","matchKind":"url","sourceKeys":["ellio"],"aliases":["reported-7"],"evidence":[{"id":"reported-7","sourceKeys":["ellio"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators.","context":"second-stage download URL.","limit":"Exact URL match; alternate paths, schemes and encodings require separate coverage.","condition":{"field":"[URL_FIELD]","op":"eq","value":"http://92.118.112.100/nfs","ignoreCase":false},"references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"http://92.118.112.100/nfs-setup","field":"[URL_FIELD]","matchKind":"url","sourceKeys":["cisa","cisaSigma","arcticWolf"],"aliases":["cisa-url-0","cisa-payload-urls"],"evidence":[{"id":"cisa-url-0","sourceKeys":["cisa","cisaSigma","arcticWolf"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"Additional URLs from the current Arctic Wolf reference; the existing /nfs URL is retained separately.","context":"Find outbound requests for the additional payload URLs in Arctic Wolf’s report referenced by CISA.","limit":"Exact full outbound URLs; alternate schemes, ports, paths and encodings need separate searches. The cCmono request used a session-poisoning/deserialization chain and does not establish exploitation of either CVE; Arctic Wolf could not retrieve that payload.","condition":{"field":"[URL_FIELD]","op":"eq","value":"http://92.118.112.100/nfs-setup"},"references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"Arctic Wolf PHP2Shell observations","url":"https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/","role":"Supporting reference"}]}],"verification":"Referenced"}],"aliases":["reported-7","cisa-url-0","cisa-payload-urls","cisa-url-1","cisa-url-2"]}
---
title: "PHP2Shell - Payload / C2 domains (3)"
id: e3172bd0-572d-5ce9-bc4f-81d87a38421f
name: php2shell_catalog_payload_domains
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find DNS queries for reported sample-associated infrastructure."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[DNS_QUERY_FIELD]":
      - "hackattackkaboom.botlesscucks.st"
      - "hik.gettingheadfromduckysmom.st"
      - "thunder.godofthunder.st"
  condition: selection_1
falsepositives:
  - "Normalize trailing DNS dots. Domain matching is case-insensitive. A lookup does not establish a connection or payload delivery; infrastructure can be reassigned."
level: low
references:
    - "https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"
    - "https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"payload-domains","group":"Payload infrastructure","cve_context":"CVE-2026-109618 / CVE-2026-109619 · campaign context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Normalize trailing DNS dots. Domain matching is case-insensitive. A lookup does not establish a connection or payload delivery; infrastructure can be reassigned.","provenance":"Grouped by evidence type and byte scope. Each member retains its matching predicate, source observations and limitations.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"},{"label":"Sophos — 22 October 21:21 UTC correction","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619"}],"members":[{"indicator":"hackattackkaboom.botlesscucks.st","field":"[DNS_QUERY_FIELD]","matchKind":"domain","sourceKeys":["ellio"],"aliases":["reported-11"],"evidence":[{"id":"reported-11","sourceKeys":["ellio"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Update, 21 October 2026, 20:50 UTC: the second stage, and where it calls home.","context":"update domain.","limit":"Normalize case and trailing dots. DNS queries may not result in connections.","condition":{"field":"[DNS_QUERY_FIELD]","op":"eq","value":"hackattackkaboom.botlesscucks.st","ignoreCase":true},"references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"hik.gettingheadfromduckysmom.st","field":"[DNS_QUERY_FIELD]","matchKind":"domain","sourceKeys":["sophos"],"aliases":["sophos-potassium-domain"],"evidence":[{"id":"sophos-potassium-domain","sourceKeys":["sophos"],"verification":"Referenced","date":"2026-10-20 / 2026-10-22","checked":"2026-10-23","provenance":"Sophos correction, 22 October 21:21 UTC: domain embedded in analyzed Potassium sample; customer exploitation attempts failed and payload was not delivered.","context":"Find DNS queries for the Potassium infrastructure domain reported by Sophos.","limit":"Sample-associated infrastructure, not evidence of delivery in the corrected customer account. Normalize DNS names and remove the trailing dot.","condition":{"field":"[DNS_QUERY_FIELD]","op":"eq","value":"hik.gettingheadfromduckysmom.st","ignoreCase":true},"references":[{"label":"Sophos — 22 October 21:21 UTC correction","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"thunder.godofthunder.st","field":"[DNS_QUERY_FIELD]","matchKind":"domain","sourceKeys":["ellio"],"aliases":["reported-9"],"evidence":[{"id":"reported-9","sourceKeys":["ellio"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Update, 21 October 2026, 20:50 UTC: the second stage, and where it calls home.","context":"C2 domain.","limit":"Normalize case and trailing dots. DNS queries may not result in connections.","condition":{"field":"[DNS_QUERY_FIELD]","op":"eq","value":"thunder.godofthunder.st","ignoreCase":true},"references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]}],"verification":"Referenced"}],"aliases":["reported-9","reported-11","sophos-potassium-domain"]}
---
title: "PHP2Shell - Payload file hashes (4)"
id: 64b284c5-cdfc-5074-967e-e7ca78e8431f
name: php2shell_catalog_payload_file_hashes
status: experimental
author: "CISA (cisa.gov), Sierra Echo Charlie (adaptation; per-member sources retained)"
description: "Find complete-file MD5, SHA-1 or SHA-256 values of reported payloads."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[FILE_SHA256_FIELD]": "0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486"
  selection_2:
    "[FILE_MD5_FIELD]": "b61a098fc62a2c2696e196dca78da71a"
  selection_3:
    "[FILE_SHA1_FIELD]": "c472dab4ff7c16782a8037f988d4daa6d4bdb343"
  selection_4:
    "[FILE_SHA256_FIELD]": "e2529d4afa39ae4db2eb05d5176317c906289abf09660c75bdeec43e54c55aa3"
  condition: (selection_1 or selection_2 or selection_3 or selection_4)
falsepositives:
  - "Each hash is compared only with its matching algorithm field. Hash complete original files, not request bodies or MIME parts. Prefer SHA-256 confirmation; sample association does not establish delivery or execution."
level: low
references:
    - "https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
    - "https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619"
    - "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"payload-file-hashes","group":"Hashes","cve_context":"CVE-2026-109618 / CVE-2026-109619 · campaign context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Each hash is compared only with its matching algorithm field. Hash complete original files, not request bodies or MIME parts. Prefer SHA-256 confirmation; sample association does not establish delivery or execution.","provenance":"Grouped by evidence type and byte scope. Each member retains its matching predicate, source observations and limitations.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"},{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"},{"label":"Sophos — 22 October 21:21 UTC correction","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619"},{"label":"Arctic Wolf PHP2Shell observations","url":"https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"}],"members":[{"indicator":"0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486","field":"[FILE_SHA256_FIELD]","matchKind":"file-sha256","sourceKeys":["ellio"],"aliases":["reported-13"],"evidence":[{"id":"reported-13","sourceKeys":["ellio"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Update, 21 October 2026, 20:50 UTC: the second stage, and where it calls home.","context":"second-stage ELF SHA-256.","limit":"Exact file bytes only; modified builds have different hashes.","condition":{"field":"[FILE_SHA256_FIELD]","op":"eq","value":"0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486","ignoreCase":true},"references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"b61a098fc62a2c2696e196dca78da71a","field":"[FILE_MD5_FIELD]","matchKind":"file-md5","sourceKeys":["ellio"],"aliases":["reported-14"],"evidence":[{"id":"reported-14","sourceKeys":["ellio"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Update, 21 October 2026, 20:50 UTC: the second stage, and where it calls home.","context":"second-stage ELF MD5.","limit":"Exact file bytes only. Prefer the accompanying SHA-256 for confirmation.","condition":{"field":"[FILE_MD5_FIELD]","op":"eq","value":"b61a098fc62a2c2696e196dca78da71a","ignoreCase":true},"references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"c472dab4ff7c16782a8037f988d4daa6d4bdb343","field":"[FILE_SHA1_FIELD]","matchKind":"file-sha1","sourceKeys":["cisa","cisaSigma","sophos"],"aliases":["cisa-payload-sha1"],"evidence":[{"id":"cisa-payload-sha1","sourceKeys":["cisa","cisaSigma","sophos"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"Sophos identifies this value as SHA-1; the matching SHA-256 is already present as reported-13.","context":"Find the complete-file SHA-1 of the payload listed by CISA and Sophos.","limit":"Hash the complete file bytes. Prefer the accompanying SHA-256 for confirmation. Sophos corrected its assessment: customer attempts failed and the payload was not delivered.","condition":{"field":"[FILE_SHA1_FIELD]","op":"eq","value":"c472dab4ff7c16782a8037f988d4daa6d4bdb343","ignoreCase":true},"references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"Sophos — 22 October 21:21 UTC correction","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"e2529d4afa39ae4db2eb05d5176317c906289abf09660c75bdeec43e54c55aa3","field":"[FILE_SHA256_FIELD]","matchKind":"file-sha256","sourceKeys":["cisa","cisaSigma","arcticWolf"],"aliases":["cisa-payload-sha256"],"evidence":[{"id":"cisa-payload-sha256","sourceKeys":["cisa","cisaSigma","arcticWolf"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"CISA and Arctic Wolf list this payload digest alongside the already-covered 0c5486f0… sample.","context":"Find the additional payload SHA-256 listed by CISA and Arctic Wolf.","limit":"Hash complete file bytes, not an HTTP body or MIME part. Infrastructure-associated malware does not establish delivery to or execution on a particular target.","condition":{"field":"[FILE_SHA256_FIELD]","op":"eq","value":"e2529d4afa39ae4db2eb05d5176317c906289abf09660c75bdeec43e54c55aa3","ignoreCase":true},"references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"Arctic Wolf PHP2Shell observations","url":"https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/","role":"Supporting reference"}]}],"verification":"Referenced"}],"aliases":["reported-13","reported-14","cisa-payload-sha1","cisa-payload-sha256"]}
---
title: "PHP2Shell - Complete request-body SHA-256 hashes (3)"
id: 3d68708c-8c3d-5faf-913f-7690654953a5
name: php2shell_catalog_request_body_hashes
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find reported hashes of complete HTTP request bodies."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[REQUEST_BODY_SHA256_FIELD]":
      - "1485e14e0f62bc94664eec341cabd275dad7d30b1d496c40ec340c9a0d9f0ba8"
      - "43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a"
      - "7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6"
  condition: selection_1
falsepositives:
  - "Hash the exact complete request-body bytes represented by each source. Headers, decoding, truncation or added newlines change the digest. These are not whole-file or MIME-part hashes."
level: low
references:
    - "https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"
    - "https://www.vulncheck.com/blog/php2shell-vulnerabilities"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"request-body-hashes","group":"Hashes","cve_context":"CVE-2026-109618 / CVE-2026-109619 · campaign context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Hash the exact complete request-body bytes represented by each source. Headers, decoding, truncation or added newlines change the digest. These are not whole-file or MIME-part hashes.","provenance":"Grouped by evidence type and byte scope. Each member retains its matching predicate, source observations and limitations.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"},{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities"}],"members":[{"indicator":"1485e14e0f62bc94664eec341cabd275dad7d30b1d496c40ec340c9a0d9f0ba8","field":"[REQUEST_BODY_SHA256_FIELD]","matchKind":"body-sha256","sourceKeys":["vulncheck"],"aliases":["reported-38"],"evidence":[{"id":"reported-38","sourceKeys":["vulncheck"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Uploaded content (SHA-256).","context":"follow-up request-body SHA-256.","limit":"Whole request-body hash; decoding or truncation changes the bytes.","condition":{"field":"[REQUEST_BODY_SHA256_FIELD]","op":"eq","value":"1485e14e0f62bc94664eec341cabd275dad7d30b1d496c40ec340c9a0d9f0ba8","ignoreCase":true},"references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a","field":"[REQUEST_BODY_SHA256_FIELD]","matchKind":"body-sha256","sourceKeys":["ellio"],"aliases":["reported-15"],"evidence":[{"id":"reported-15","sourceKeys":["ellio"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators.","context":"session-path request-body SHA-256.","limit":"Whole request-body hash; decoding or truncation changes the bytes.","condition":{"field":"[REQUEST_BODY_SHA256_FIELD]","op":"eq","value":"43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a","ignoreCase":true},"references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6","field":"[REQUEST_BODY_SHA256_FIELD]","matchKind":"body-sha256","sourceKeys":["ellio"],"aliases":["reported-16"],"evidence":[{"id":"reported-16","sourceKeys":["ellio"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators.","context":"out-of-memory request-body SHA-256.","limit":"Whole request-body hash; decoding or truncation changes the bytes.","condition":{"field":"[REQUEST_BODY_SHA256_FIELD]","op":"eq","value":"7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6","ignoreCase":true},"references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]}],"verification":"Referenced"}],"aliases":["reported-15","reported-16","reported-38"]}
---
title: "PHP2Shell - Scanner User-Agent fingerprints (14)"
id: fb8dfe20-68d3-5d82-a87d-cdb02bbaf765
name: php2shell_catalog_scanner_user_agents
status: experimental
author: "CISA (cisa.gov), Sierra Echo Charlie (adaptation; per-member sources retained)"
description: "Find reported scanner User-Agents and the broader tool-name fragments listed by CISA."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[USER_AGENT_FIELD]|cased": "Mozilla/5.0 (php2shell-poc)"
  selection_2:
    "[USER_AGENT_FIELD]|contains": "p2s-"
  selection_3:
    "[USER_AGENT_FIELD]|cased": "php-upload-progress-scan/1.0 (internal, authorized-use-only)"
  selection_4:
    "[USER_AGENT_FIELD]|contains": "php2shell"
  selection_5:
    "[USER_AGENT_FIELD]|cased": "php2shell-109618"
  selection_6:
    "[USER_AGENT_FIELD]|contains": "php2shell-109618"
  selection_7:
    "[USER_AGENT_FIELD]|contains": "php2shell-109619"
  selection_8:
    "[USER_AGENT_FIELD]|contains": "php2shell-poc"
  selection_9:
    "[USER_AGENT_FIELD]|contains": "php2shell-scan"
  selection_10:
    "[USER_AGENT_FIELD]|cased": "php2shell-scan/1.3 (eigen-oppervlak controle; CVE-2026-109618/109619)"
  selection_11:
    "[USER_AGENT_FIELD]|cased": "php2shell-scan/109618"
  selection_12:
    "[USER_AGENT_FIELD]|contains": "php2shell-verify"
  selection_13:
    "[USER_AGENT_FIELD]|cased": "php2shell-verify/1.0"
  selection_14:
    "[USER_AGENT_FIELD]": "phpshellscan/2.0"
  selection_15:
    "[USER_AGENT_FIELD]": "wide-cve-2026-109618/1.0"
  condition: (selection_1 or selection_2 or selection_3 or selection_4 or selection_5 or selection_6 or selection_7 or selection_8 or selection_9 or selection_10 or selection_11 or selection_12 or selection_13 or selection_14 or selection_15)
falsepositives:
  - "Exact reported values and case-insensitive fragments are separate alternatives. A fragment match can include tool versions not explicitly observed. These strings identify tooling, not successful exploitation."
level: low
references:
    - "https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"
    - "https://www.vulncheck.com/blog/php2shell-vulnerabilities"
    - "https://www.greynoise.io/"
    - "https://php.events.greynoise.io/"
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
    - "https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"
    - "https://www.f5.com/labs/articles/php2shell-exploitation-attempts-observed"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"scanner-user-agents","group":"Request fingerprints","cve_context":"CVE-2026-109618 / CVE-2026-109619 · campaign context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Exact reported values and case-insensitive fragments are separate alternatives. A fragment match can include tool versions not explicitly observed. These strings identify tooling, not successful exploitation.","provenance":"Grouped by evidence type and byte scope. Each member retains its matching predicate, source observations and limitations.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"},{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities"},{"label":"GreyNoise","url":"https://www.greynoise.io/"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/"},{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"},{"label":"F5 observed PHP2Shell attempts","url":"https://www.f5.com/labs/articles/php2shell-exploitation-attempts-observed"}],"members":[{"indicator":"Mozilla/5.0 (php2shell-poc)","field":"[USER_AGENT_FIELD]","matchKind":"ua","sourceKeys":["vulncheck"],"aliases":["reported-29"],"evidence":[{"id":"reported-29","sourceKeys":["vulncheck"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Network / Timeline.","context":"HTTP User-Agent.","limit":"Exact User-Agent; tooling can change it or be used in authorized tests.","condition":{"field":"[USER_AGENT_FIELD]","op":"eq","value":"Mozilla/5.0 (php2shell-poc)","ignoreCase":false},"references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"p2s-","field":"[USER_AGENT_FIELD]","matchKind":"ua","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-ua-p2s"],"evidence":[{"id":"greynoise-event-ua-p2s","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","provenance":"GreyNoise Observed User-Agents table, 30 October 2026. Covers GreyNoise-observed p2s-scan, p2s-check/1.0, p2s-okscan/1.0 and p2s-probe/1.0.","context":"Find User-Agents containing a PHP2Shell tool-name fragment.","limit":"Tool names identify scanners, many self-described as authorized testing; they do not establish exploitation. Fragment matches are case-insensitive.","condition":{"field":"[USER_AGENT_FIELD]","op":"contains","value":"p2s-","ignoreCase":true},"references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"php-upload-progress-scan/1.0 (internal, authorized-use-only)","field":"[USER_AGENT_FIELD]","matchKind":"ua","sourceKeys":["f5"],"aliases":["f5-upload-scanner-ua"],"evidence":[{"id":"f5-upload-scanner-ua","sourceKeys":["f5"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"Source supports the detection approach. Field mappings, thresholds and matching scope are local adaptations.","context":"Find the upload-progress scanner User-Agent observed by F5.","limit":"Exact observed tooling string; it does not establish authorization or successful exploitation.","condition":{"field":"[USER_AGENT_FIELD]","op":"eq","value":"php-upload-progress-scan/1.0 (internal, authorized-use-only)"},"references":[{"label":"F5 observed PHP2Shell attempts","url":"https://www.f5.com/labs/articles/php2shell-exploitation-attempts-observed","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"php2shell","field":"[USER_AGENT_FIELD]","matchKind":"ua","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-ua-php2shell"],"evidence":[{"id":"greynoise-event-ua-php2shell","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","provenance":"GreyNoise Observed User-Agents table, 30 October 2026. Covers GreyNoise-observed php2shell/1.0, php2shell-check, php2shell-auto, php2shell-scan/2.0 and 3.1, shellflow-php2shell/1.0, PHP2ShellScanner/1.3–1.8, BlackSight-PHP2Shell-Checker and Lab-PHP2Shell-Audit, among 40+ variants.","context":"Find User-Agents containing a PHP2Shell tool-name fragment.","limit":"Tool names identify scanners, many self-described as authorized testing; they do not establish exploitation. Fragment matches are case-insensitive.","condition":{"field":"[USER_AGENT_FIELD]","op":"contains","value":"php2shell","ignoreCase":true},"references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"php2shell-109618","field":"[USER_AGENT_FIELD]","matchKind":"ua","sourceKeys":["ellio","cisa","cisaSigma","zest"],"aliases":["reported-18","cisa-fingerprint-php2shell-109618"],"evidence":[{"id":"reported-18","sourceKeys":["ellio"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators.","context":"HTTP User-Agent.","limit":"Exact User-Agent; tooling can change it or be used in authorized tests.","condition":{"field":"[USER_AGENT_FIELD]","op":"eq","value":"php2shell-109618","ignoreCase":false},"references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]},{"id":"cisa-fingerprint-php2shell-109618","sourceKeys":["cisa","cisaSigma","zest"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"Fingerprint from CISA and its ZEST reference. Broader User-Agent fragments are hunting choices, not exact observed User-Agent strings.","context":"Find reported scanner User-Agent fragments, multipart boundaries or the bgctxpoc session-cookie value.","limit":"Independent fingerprint alternatives; no POST or upload-progress requirement. Parse the boundary parameter without quotes or MIME delimiter hyphens. Map PHPSESSID_COOKIE to the cookie value only. Missing fields may still match another alternative. Defaults are mutable and authorized testing can match.","condition":{"field":"[USER_AGENT_FIELD]","op":"contains","value":"php2shell-109618","ignoreCase":true},"references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"php2shell-109619","field":"[USER_AGENT_FIELD]","matchKind":"ua","sourceKeys":["cisa","cisaSigma","zest"],"aliases":["cisa-fingerprint-php2shell-109619"],"evidence":[{"id":"cisa-fingerprint-php2shell-109619","sourceKeys":["cisa","cisaSigma","zest"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"Fingerprint from CISA and its ZEST reference. Broader User-Agent fragments are hunting choices, not exact observed User-Agent strings.","context":"Find reported scanner User-Agent fragments, multipart boundaries or the bgctxpoc session-cookie value.","limit":"Independent fingerprint alternatives; no POST or upload-progress requirement. Parse the boundary parameter without quotes or MIME delimiter hyphens. Map PHPSESSID_COOKIE to the cookie value only. Missing fields may still match another alternative. Defaults are mutable and authorized testing can match.","condition":{"field":"[USER_AGENT_FIELD]","op":"contains","value":"php2shell-109619","ignoreCase":true},"references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"php2shell-poc","field":"[USER_AGENT_FIELD]","matchKind":"ua","sourceKeys":["cisa","cisaSigma","zest"],"aliases":["cisa-fingerprint-php2shell-poc"],"evidence":[{"id":"cisa-fingerprint-php2shell-poc","sourceKeys":["cisa","cisaSigma","zest"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"Fingerprint from CISA and its ZEST reference. Broader User-Agent fragments are hunting choices, not exact observed User-Agent strings.","context":"Find reported scanner User-Agent fragments, multipart boundaries or the bgctxpoc session-cookie value.","limit":"Independent fingerprint alternatives; no POST or upload-progress requirement. Parse the boundary parameter without quotes or MIME delimiter hyphens. Map PHPSESSID_COOKIE to the cookie value only. Missing fields may still match another alternative. Defaults are mutable and authorized testing can match.","condition":{"field":"[USER_AGENT_FIELD]","op":"contains","value":"php2shell-poc","ignoreCase":true},"references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"php2shell-scan","field":"[USER_AGENT_FIELD]","matchKind":"ua","sourceKeys":["cisa","cisaSigma","zest"],"aliases":["cisa-fingerprint-php2shell-scan"],"evidence":[{"id":"cisa-fingerprint-php2shell-scan","sourceKeys":["cisa","cisaSigma","zest"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"Fingerprint from CISA and its ZEST reference. Broader User-Agent fragments are hunting choices, not exact observed User-Agent strings.","context":"Find reported scanner User-Agent fragments, multipart boundaries or the bgctxpoc session-cookie value.","limit":"Independent fingerprint alternatives; no POST or upload-progress requirement. Parse the boundary parameter without quotes or MIME delimiter hyphens. Map PHPSESSID_COOKIE to the cookie value only. Missing fields may still match another alternative. Defaults are mutable and authorized testing can match.","condition":{"field":"[USER_AGENT_FIELD]","op":"contains","value":"php2shell-scan","ignoreCase":true},"references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"php2shell-scan/1.3 (eigen-oppervlak controle; CVE-2026-109618/109619)","field":"[USER_AGENT_FIELD]","matchKind":"ua","sourceKeys":["vulncheck"],"aliases":["reported-28"],"evidence":[{"id":"reported-28","sourceKeys":["vulncheck"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Network / Timeline.","context":"HTTP User-Agent.","limit":"Exact User-Agent; tooling can change it or be used in authorized tests.","condition":{"field":"[USER_AGENT_FIELD]","op":"eq","value":"php2shell-scan/1.3 (eigen-oppervlak controle; CVE-2026-109618/109619)","ignoreCase":false},"references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"php2shell-scan/109618","field":"[USER_AGENT_FIELD]","matchKind":"ua","sourceKeys":["ellio"],"aliases":["reported-17"],"evidence":[{"id":"reported-17","sourceKeys":["ellio"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators.","context":"HTTP User-Agent.","limit":"Exact User-Agent; tooling can change it or be used in authorized tests.","condition":{"field":"[USER_AGENT_FIELD]","op":"eq","value":"php2shell-scan/109618","ignoreCase":false},"references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"php2shell-verify","field":"[USER_AGENT_FIELD]","matchKind":"ua","sourceKeys":["cisa","cisaSigma","zest"],"aliases":["cisa-fingerprint-php2shell-verify"],"evidence":[{"id":"cisa-fingerprint-php2shell-verify","sourceKeys":["cisa","cisaSigma","zest"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"Fingerprint from CISA and its ZEST reference. Broader User-Agent fragments are hunting choices, not exact observed User-Agent strings.","context":"Find reported scanner User-Agent fragments, multipart boundaries or the bgctxpoc session-cookie value.","limit":"Independent fingerprint alternatives; no POST or upload-progress requirement. Parse the boundary parameter without quotes or MIME delimiter hyphens. Map PHPSESSID_COOKIE to the cookie value only. Missing fields may still match another alternative. Defaults are mutable and authorized testing can match.","condition":{"field":"[USER_AGENT_FIELD]","op":"contains","value":"php2shell-verify","ignoreCase":true},"references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"php2shell-verify/1.0","field":"[USER_AGENT_FIELD]","matchKind":"ua","sourceKeys":["ellio"],"aliases":["reported-19"],"evidence":[{"id":"reported-19","sourceKeys":["ellio"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators.","context":"HTTP User-Agent.","limit":"Exact User-Agent; tooling can change it or be used in authorized tests.","condition":{"field":"[USER_AGENT_FIELD]","op":"eq","value":"php2shell-verify/1.0","ignoreCase":false},"references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"phpshellscan/2.0","field":"[USER_AGENT_FIELD]","matchKind":"ua","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-ua-phpshellscan-2-0"],"evidence":[{"id":"greynoise-event-ua-phpshellscan-2-0","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","provenance":"GreyNoise Observed User-Agents table, 30 October 2026. Exact User-Agent GreyNoise observed on a tracked source.","context":"Find an exact PHP2Shell-labelled tool User-Agent.","limit":"Tool names identify scanners, many self-described as authorized testing; they do not establish exploitation. Fragment matches are case-insensitive.","condition":{"field":"[USER_AGENT_FIELD]","op":"eq","value":"phpshellscan/2.0","ignoreCase":true},"references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"wide-cve-2026-109618/1.0","field":"[USER_AGENT_FIELD]","matchKind":"ua","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-ua-wide-cve-2026-109618-1-0"],"evidence":[{"id":"greynoise-event-ua-wide-cve-2026-109618-1-0","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","provenance":"GreyNoise Observed User-Agents table, 30 October 2026. Exact User-Agent GreyNoise observed on a tracked source.","context":"Find an exact PHP2Shell-labelled tool User-Agent.","limit":"Tool names identify scanners, many self-described as authorized testing; they do not establish exploitation. Fragment matches are case-insensitive.","condition":{"field":"[USER_AGENT_FIELD]","op":"eq","value":"wide-cve-2026-109618/1.0","ignoreCase":true},"references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"}],"aliases":["reported-17","reported-18","reported-19","reported-28","reported-29","greynoise-event-ua-php2shell","greynoise-event-ua-p2s","greynoise-event-ua-wide-cve-2026-109618-1-0","greynoise-event-ua-phpshellscan-2-0","cisa-fingerprint-php2shell-scan","cisa-fingerprint-php2shell-verify","cisa-fingerprint-php2shell-poc","cisa-fingerprint-php2shell-109618","cisa-fingerprint-php2shell-109619","f5-upload-scanner-ua"]}
---
title: "PHP2Shell - Multipart boundary fingerprints (10)"
id: a3e557f7-285f-55dc-a4b9-6de0c2df3208
name: php2shell_catalog_multipart_boundaries
status: experimental
author: "CISA (cisa.gov), Sierra Echo Charlie (adaptation; per-member sources retained)"
description: "Find reported multipart boundary values across sources."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[MULTIPART_BOUNDARY_FIELD]|cased":
      - "------p2s9rdme2st6guc9g0rafic"
      - "----lf"
      - "----p2shell"
      - "----rceStock"
      - "B7kQpoc618"
      - "B7kQpoc619"
      - "BBBBBBBBBB"
      - "BGCTXBOUNDARY"
      - "BNDRY12345"
      - "SSSSSSSSSSSSSSSSS"
  condition: selection_1
falsepositives:
  - "Compare the parsed boundary parameter exactly, without surrounding quotes or the two MIME delimiter hyphens. Preserve hyphens that are part of the parameter value. Fingerprints are mutable and authorized tests can match."
level: low
references:
    - "https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"
    - "https://www.vulncheck.com/blog/php2shell-vulnerabilities"
    - "https://www.greynoise.io/"
    - "https://php.events.greynoise.io/"
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
    - "https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"
    - "https://github.com/9bie/php2shell-bypass-aslr-exp/blob/4586f5cc120c82fd468b17469202bac629810ad9/exploit.py"
    - "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC/blob/main/poc_109618.py"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"multipart-boundaries","group":"Request fingerprints","cve_context":"CVE-2026-109618 / CVE-2026-109619 · campaign context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Compare the parsed boundary parameter exactly, without surrounding quotes or the two MIME delimiter hyphens. Preserve hyphens that are part of the parameter value. Fingerprints are mutable and authorized tests can match.","provenance":"Grouped by evidence type and byte scope. Each member retains its matching predicate, source observations and limitations.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"},{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities"},{"label":"GreyNoise","url":"https://www.greynoise.io/"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/"},{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"},{"label":"9bie PoC — static source reference","url":"https://github.com/9bie/php2shell-bypass-aslr-exp/blob/4586f5cc120c82fd468b17469202bac629810ad9/exploit.py"},{"label":"eness PoC — static source reference","url":"https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC/blob/main/poc_109618.py"}],"members":[{"indicator":"------p2s9rdme2st6guc9g0rafic","field":"[MULTIPART_BOUNDARY_FIELD]","matchKind":"boundary","sourceKeys":["vulncheck"],"aliases":["reported-32"],"evidence":[{"id":"reported-32","sourceKeys":["vulncheck"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Network / Timeline.","context":"multipart boundary.","limit":"Boundary representations vary between parsers and raw MIME delimiters.","condition":{"field":"[MULTIPART_BOUNDARY_FIELD]","op":"eq","value":"------p2s9rdme2st6guc9g0rafic","ignoreCase":false},"references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"----lf","field":"[MULTIPART_BOUNDARY_FIELD]","matchKind":"boundary","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-boundary-lf"],"evidence":[{"id":"greynoise-event-boundary-lf","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":"2026-10-28 – 2026-10-29","checked":"2026-10-30","provenance":"Request Content-Type boundary on the 2.59.133.151 exploitation sessions that GreyNoise confirmed as successful exploitation.","context":"Find a multipart boundary seen on confirmed GreyNoise exploitation sessions.","limit":"Boundaries are trivially changed and can be reused by unrelated tools.","condition":{"field":"[MULTIPART_BOUNDARY_FIELD]","op":"eq","value":"----lf","ignoreCase":false},"references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"----p2shell","field":"[MULTIPART_BOUNDARY_FIELD]","matchKind":"boundary","sourceKeys":["ellio"],"aliases":["reported-20"],"evidence":[{"id":"reported-20","sourceKeys":["ellio"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators.","context":"multipart boundary.","limit":"Boundary representations vary between parsers and raw MIME delimiters.","condition":{"field":"[MULTIPART_BOUNDARY_FIELD]","op":"eq","value":"----p2shell","ignoreCase":false},"references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"----rceStock","field":"[MULTIPART_BOUNDARY_FIELD]","matchKind":"boundary","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-boundary-rcestock"],"evidence":[{"id":"greynoise-event-boundary-rcestock","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":"2026-10-28 – 2026-10-29","checked":"2026-10-30","provenance":"Request Content-Type boundary on the 2.59.133.151 exploitation sessions that GreyNoise confirmed as successful exploitation.","context":"Find a multipart boundary seen on confirmed GreyNoise exploitation sessions.","limit":"Boundaries are trivially changed and can be reused by unrelated tools.","condition":{"field":"[MULTIPART_BOUNDARY_FIELD]","op":"eq","value":"----rceStock","ignoreCase":false},"references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"B7kQpoc618","field":"[MULTIPART_BOUNDARY_FIELD]","matchKind":"boundary","sourceKeys":["cisa","cisaSigma","zest"],"aliases":["cisa-fingerprint-B7kQpoc618"],"evidence":[{"id":"cisa-fingerprint-B7kQpoc618","sourceKeys":["cisa","cisaSigma","zest"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"Fingerprint from CISA and its ZEST reference. Broader User-Agent fragments are hunting choices, not exact observed User-Agent strings.","context":"Find reported scanner User-Agent fragments, multipart boundaries or the bgctxpoc session-cookie value.","limit":"Independent fingerprint alternatives; no POST or upload-progress requirement. Parse the boundary parameter without quotes or MIME delimiter hyphens. Map PHPSESSID_COOKIE to the cookie value only. Missing fields may still match another alternative. Defaults are mutable and authorized testing can match.","condition":{"field":"[MULTIPART_BOUNDARY_FIELD]","op":"eq","value":"B7kQpoc618"},"references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"B7kQpoc619","field":"[MULTIPART_BOUNDARY_FIELD]","matchKind":"boundary","sourceKeys":["cisa","cisaSigma","zest"],"aliases":["cisa-fingerprint-B7kQpoc619"],"evidence":[{"id":"cisa-fingerprint-B7kQpoc619","sourceKeys":["cisa","cisaSigma","zest"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"Fingerprint from CISA and its ZEST reference. Broader User-Agent fragments are hunting choices, not exact observed User-Agent strings.","context":"Find reported scanner User-Agent fragments, multipart boundaries or the bgctxpoc session-cookie value.","limit":"Independent fingerprint alternatives; no POST or upload-progress requirement. Parse the boundary parameter without quotes or MIME delimiter hyphens. Map PHPSESSID_COOKIE to the cookie value only. Missing fields may still match another alternative. Defaults are mutable and authorized testing can match.","condition":{"field":"[MULTIPART_BOUNDARY_FIELD]","op":"eq","value":"B7kQpoc619"},"references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"BBBBBBBBBB","field":"[MULTIPART_BOUNDARY_FIELD]","matchKind":"boundary","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-boundary-bbbbbbbbbb"],"evidence":[{"id":"greynoise-event-boundary-bbbbbbbbbb","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":"2026-10-29","checked":"2026-10-30","provenance":"Request Content-Type boundary on the 185.65.134.250 exploitation sessions that GreyNoise confirmed as successful exploitation.","context":"Find a multipart boundary seen on confirmed GreyNoise exploitation sessions.","limit":"Boundaries are trivially changed and can be reused by unrelated tools.","condition":{"field":"[MULTIPART_BOUNDARY_FIELD]","op":"eq","value":"BBBBBBBBBB","ignoreCase":false},"references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"BGCTXBOUNDARY","field":"[MULTIPART_BOUNDARY_FIELD]","matchKind":"boundary","sourceKeys":["cisa","cisaSigma","zest"],"aliases":["cisa-fingerprint-BGCTXBOUNDARY"],"evidence":[{"id":"cisa-fingerprint-BGCTXBOUNDARY","sourceKeys":["cisa","cisaSigma","zest"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"Fingerprint from CISA and its ZEST reference. Broader User-Agent fragments are hunting choices, not exact observed User-Agent strings.","context":"Find reported scanner User-Agent fragments, multipart boundaries or the bgctxpoc session-cookie value.","limit":"Independent fingerprint alternatives; no POST or upload-progress requirement. Parse the boundary parameter without quotes or MIME delimiter hyphens. Map PHPSESSID_COOKIE to the cookie value only. Missing fields may still match another alternative. Defaults are mutable and authorized testing can match.","condition":{"field":"[MULTIPART_BOUNDARY_FIELD]","op":"eq","value":"BGCTXBOUNDARY"},"references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"BNDRY12345","field":"[MULTIPART_BOUNDARY_FIELD]","matchKind":"boundary","sourceKeys":["cisa","cisaSigma","poc9bie","pocEness"],"aliases":["cisa-fingerprint-BNDRY12345"],"evidence":[{"id":"cisa-fingerprint-BNDRY12345","sourceKeys":["cisa","cisaSigma","poc9bie","pocEness"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"Boundary appears in the two statically reviewed PoCs and CISA’s request-marker branch.","context":"Find reported scanner User-Agent fragments, multipart boundaries or the bgctxpoc session-cookie value.","limit":"Independent fingerprint alternatives; no POST or upload-progress requirement. Parse the boundary parameter without quotes or MIME delimiter hyphens. Map PHPSESSID_COOKIE to the cookie value only. Missing fields may still match another alternative. Defaults are mutable and authorized testing can match.","condition":{"field":"[MULTIPART_BOUNDARY_FIELD]","op":"eq","value":"BNDRY12345"},"references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"9bie PoC — static source reference","url":"https://github.com/9bie/php2shell-bypass-aslr-exp/blob/4586f5cc120c82fd468b17469202bac629810ad9/exploit.py","role":"Supporting reference"},{"label":"eness PoC — static source reference","url":"https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC/blob/main/poc_109618.py","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"SSSSSSSSSSSSSSSSS","field":"[MULTIPART_BOUNDARY_FIELD]","matchKind":"boundary","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-boundary-sssssssssssssssss"],"evidence":[{"id":"greynoise-event-boundary-sssssssssssssssss","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":"2026-10-29","checked":"2026-10-30","provenance":"Request Content-Type boundary on the 185.65.134.250 exploitation sessions that GreyNoise confirmed as successful exploitation.","context":"Find a multipart boundary seen on confirmed GreyNoise exploitation sessions.","limit":"Boundaries are trivially changed and can be reused by unrelated tools.","condition":{"field":"[MULTIPART_BOUNDARY_FIELD]","op":"eq","value":"SSSSSSSSSSSSSSSSS","ignoreCase":false},"references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"}],"aliases":["reported-20","reported-32","greynoise-event-boundary-lf","greynoise-event-boundary-rcestock","greynoise-event-boundary-bbbbbbbbbb","greynoise-event-boundary-sssssssssssssssss","cisa-fingerprint-B7kQpoc618","cisa-fingerprint-B7kQpoc619","cisa-fingerprint-BGCTXBOUNDARY","cisa-fingerprint-BNDRY12345"]}
---
title: "PHP2Shell - Response execution-test markers (5)"
id: 16c63ce5-6b78-5135-863c-fac94a4564dc
name: php2shell_catalog_response_markers
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find reported test markers in response bodies."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[RESPONSE_BODY_FIELD]|contains|cased": "___PHP2SHELL_END___"
  selection_2:
    "[RESPONSE_BODY_FIELD]|contains|cased": "___PHP2SHELL_START___"
  selection_3:
    "[RESPONSE_BODY_FIELD]|contains|cased": "JACKALPOC"
  selection_4:
    "[RESPONSE_BODY_FIELD]|contains|cased": "PWNED::"
  selection_5:
    "[RESPONSE_BODY_FIELD]|contains|cased": "RCE_uT3Ji6oaEWOwI3VB"
  condition: (selection_1 or selection_2 or selection_3 or selection_4 or selection_5)
falsepositives:
  - "Literal marker presence can result from reflection or documentation. Confirm that the application evaluated injected content before interpreting it as execution."
level: low
references:
    - "https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"
    - "https://www.vulncheck.com/blog/php2shell-vulnerabilities"
    - "https://www.greynoise.io/"
    - "https://php.events.greynoise.io/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"response-markers","group":"Request fingerprints","cve_context":"CVE-2026-109618 / CVE-2026-109619 · campaign context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Literal marker presence can result from reflection or documentation. Confirm that the application evaluated injected content before interpreting it as execution.","provenance":"Grouped by evidence type and byte scope. Each member retains its matching predicate, source observations and limitations.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"},{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities"},{"label":"GreyNoise","url":"https://www.greynoise.io/"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/"}],"members":[{"indicator":"___PHP2SHELL_END___","field":"[RESPONSE_BODY_FIELD]","matchKind":"marker","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-marker-php2shellend"],"evidence":[{"id":"greynoise-event-marker-php2shellend","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","provenance":"Echoed around system(base64_decode('aWQ=')) (id) in a PHP payload GreyNoise observed in a User-Agent.","context":"Find a PHP2Shell execution-test marker in a response body.","limit":"Reflection of the injected text also matches. Confirm evaluation before treating a match as execution.","condition":{"field":"[RESPONSE_BODY_FIELD]","op":"contains","value":"___PHP2SHELL_END___","ignoreCase":false},"references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"___PHP2SHELL_START___","field":"[RESPONSE_BODY_FIELD]","matchKind":"marker","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-marker-php2shellstart"],"evidence":[{"id":"greynoise-event-marker-php2shellstart","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","provenance":"Echoed around system(base64_decode('aWQ=')) (id) in a PHP payload GreyNoise observed in a User-Agent.","context":"Find a PHP2Shell execution-test marker in a response body.","limit":"Reflection of the injected text also matches. Confirm evaluation before treating a match as execution.","condition":{"field":"[RESPONSE_BODY_FIELD]","op":"contains","value":"___PHP2SHELL_START___","ignoreCase":false},"references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"JACKALPOC","field":"[RESPONSE_BODY_FIELD]","matchKind":"marker","sourceKeys":["ellio"],"aliases":["reported-21"],"evidence":[{"id":"reported-21","sourceKeys":["ellio"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators.","context":"proof-of-concept command output marker.","limit":"Response reflection can also produce this marker.","condition":{"field":"[RESPONSE_BODY_FIELD]","op":"contains","value":"JACKALPOC","ignoreCase":false},"references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"PWNED::","field":"[RESPONSE_BODY_FIELD]","matchKind":"marker","sourceKeys":["vulncheck"],"aliases":["reported-34"],"evidence":[{"id":"reported-34","sourceKeys":["vulncheck"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Network / Timeline.","context":"Marker in attempted session-file payload; reported file readbacks returned 404. A response match alone could be reflected content.","limit":"Response reflection can also produce this marker.","condition":{"field":"[RESPONSE_BODY_FIELD]","op":"contains","value":"PWNED::","ignoreCase":false},"references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"RCE_uT3Ji6oaEWOwI3VB","field":"[RESPONSE_BODY_FIELD]","matchKind":"marker","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-marker-rceut3ji6oaewowi3vb"],"evidence":[{"id":"greynoise-event-marker-rceut3ji6oaewowi3vb","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","provenance":"Decoded from a base64 system() payload GreyNoise observed in a User-Agent: echo RCE_uT3Ji6oaEWOwI3VB;id;echo RCE_uT3Ji6oaEWOwI3VB.","context":"Find a PHP2Shell execution-test marker in a response body.","limit":"Reflection of the injected text also matches. Confirm evaluation before treating a match as execution.","condition":{"field":"[RESPONSE_BODY_FIELD]","op":"contains","value":"RCE_uT3Ji6oaEWOwI3VB","ignoreCase":false},"references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"}],"aliases":["reported-21","reported-34","greynoise-event-marker-php2shellstart","greynoise-event-marker-php2shellend","greynoise-event-marker-rceut3ji6oaewowi3vb"]}
---
title: "PHP2Shell - PHP_SESSION_UPLOAD_PROGRESS"
id: 36467ebf-6c2b-5d0f-b4ce-e11c1ddae1f7
name: php2shell_catalog_reported_22
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Also present in legitimate uploads and older session-file techniques; not specific to either CVE."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[FORM_FIELD_NAME_FIELD]|cased": "PHP_SESSION_UPLOAD_PROGRESS"
  condition: selection_1
falsepositives:
  - "Legitimate upload-progress field; also used by older session-file techniques."
level: low
references:
    - "https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"reported-22","group":"Request fingerprints","cve_context":"CVE-2026-109618 / CVE-2026-109619 · campaign context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - xqsuvwz3n97wu8j3emz1axuo5y"
id: 93280315-c469-5d61-a79a-bc6b736acbe3
name: php2shell_catalog_reported_30
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "PHP session ID."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[PHP_SESSION_ID_FIELD]|cased": "xqsuvwz3n97wu8j3emz1axuo5y"
  condition: selection_1
falsepositives:
  - "Per-run session value; may be reused by tooling."
level: low
references:
    - "https://www.vulncheck.com/blog/php2shell-vulnerabilities"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"reported-30","group":"Request fingerprints","cve_context":"CVE-2026-109618 / CVE-2026-109619 · campaign context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Network / Timeline.","references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - sess_xqsuvwz3n97wu8j3emz1axuo5y"
id: 10672e2a-08dc-5e6f-bf2b-9883958547e8
name: php2shell_catalog_reported_31
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "PHP session filename."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[FILENAME_FIELD]|cased": "sess_xqsuvwz3n97wu8j3emz1axuo5y"
  condition: selection_1
falsepositives:
  - "Basename match; inspect under the configured session.save_path."
level: low
references:
    - "https://www.vulncheck.com/blog/php2shell-vulnerabilities"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"reported-31","group":"Request fingerprints","cve_context":"CVE-2026-109618 / CVE-2026-109619 · campaign context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Network / Timeline.","references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - p2s.txt"
id: e6c68c74-5b6a-590c-93f0-d82ad9d1dbab
name: php2shell_catalog_reported_33
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "upload filename."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[UPLOAD_FILENAME_FIELD]|cased": "p2s.txt"
  condition: selection_1
falsepositives:
  - "Low-specificity filename; pair with the part hash or request context."
level: low
references:
    - "https://www.vulncheck.com/blog/php2shell-vulnerabilities"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"reported-33","group":"Request fingerprints","cve_context":"CVE-2026-109618 / CVE-2026-109619 · campaign context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Network / Timeline.","references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - MIME-part content SHA-256 hashes (3)"
id: abe0c0a4-a995-5197-9479-d082910391d2
name: php2shell_catalog_mime_part_hashes
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find reported hashes of extracted MIME-part content."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[MIME_PART_SHA256_FIELD]":
      - "150ae88f0999032e2a6113501d6082f54a3ed98d02427b21a96e773a27d7bf16"
      - "27d926a6708d6769d97d065e7a5a860ab496eab272c03d1cebc55ec71b954fa2"
      - "40caf199ca1ebe056a74427f8e9db06c66899e33ae09c0ec2769ec70bf6dd8e7"
  condition: selection_1
falsepositives:
  - "Hash the part content only, excluding MIME headers and delimiters. These are not hashes of the whole request or saved multipart envelope."
level: low
references:
    - "https://www.vulncheck.com/blog/php2shell-vulnerabilities"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"mime-part-hashes","group":"Hashes","cve_context":"CVE-2026-109618 / CVE-2026-109619 · campaign context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Hash the part content only, excluding MIME headers and delimiters. These are not hashes of the whole request or saved multipart envelope.","provenance":"Grouped by evidence type and byte scope. Each member retains its matching predicate, source observations and limitations.","references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities"}],"members":[{"indicator":"150ae88f0999032e2a6113501d6082f54a3ed98d02427b21a96e773a27d7bf16","field":"[MIME_PART_SHA256_FIELD]","matchKind":"part-sha256","sourceKeys":["vulncheck"],"aliases":["reported-35"],"evidence":[{"id":"reported-35","sourceKeys":["vulncheck"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Uploaded content (SHA-256).","context":"uploaded part SHA-256.","limit":"Hash the part content, excluding MIME headers and delimiters.","condition":{"field":"[MIME_PART_SHA256_FIELD]","op":"eq","value":"150ae88f0999032e2a6113501d6082f54a3ed98d02427b21a96e773a27d7bf16","ignoreCase":true},"references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"27d926a6708d6769d97d065e7a5a860ab496eab272c03d1cebc55ec71b954fa2","field":"[MIME_PART_SHA256_FIELD]","matchKind":"part-sha256","sourceKeys":["vulncheck"],"aliases":["reported-37"],"evidence":[{"id":"reported-37","sourceKeys":["vulncheck"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Uploaded content (SHA-256).","context":"uploaded part SHA-256.","limit":"Hash the part content, excluding MIME headers and delimiters.","condition":{"field":"[MIME_PART_SHA256_FIELD]","op":"eq","value":"27d926a6708d6769d97d065e7a5a860ab496eab272c03d1cebc55ec71b954fa2","ignoreCase":true},"references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"40caf199ca1ebe056a74427f8e9db06c66899e33ae09c0ec2769ec70bf6dd8e7","field":"[MIME_PART_SHA256_FIELD]","matchKind":"part-sha256","sourceKeys":["vulncheck"],"aliases":["reported-36"],"evidence":[{"id":"reported-36","sourceKeys":["vulncheck"],"verification":"Referenced","date":null,"checked":"2026-10-22","provenance":"Exact value referenced. Checked 22 October 2026. Section: Indicators of compromise → Uploaded content (SHA-256).","context":"uploaded part SHA-256.","limit":"Hash the part content, excluding MIME headers and delimiters.","condition":{"field":"[MIME_PART_SHA256_FIELD]","op":"eq","value":"40caf199ca1ebe056a74427f8e9db06c66899e33ae09c0ec2769ec70bf6dd8e7","ignoreCase":true},"references":[{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities","role":"Supporting reference"}]}],"verification":"Referenced"}],"aliases":["reported-35","reported-36","reported-37"]}
---
title: "PHP2Shell - HTTP JA4H fingerprints (6)"
id: 662bf216-d648-54b7-9250-c3e0c89dec42
name: php2shell_catalog_http_ja4h
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find reported HTTP fingerprints in the same JA4H representation used by the source."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[JA4H_FIELD]|cased":
      - "ge11nn030000_52193b36b64e_000000000000_000000000000"
      - "po10nn060000_efc8bc7e3e52_000000000000"
      - "po10nn150000_94b423c72d17_000000000000"
      - "po11cn040000_0f012dde03cf_fe81d65a9ab0_2b5ca3dd2edc"
      - "po11nn040000_0f012dde03cf_000000000000_000000000000"
      - "po11nn050000_c79a52b7736c_000000000000_000000000000"
  condition: selection_1
falsepositives:
  - "Fingerprint matches can include unrelated traffic. Preserve the full reported JA4H representation; do not substitute JA4 TLS hashes or a differently truncated JA4H."
level: low
references:
    - "https://offseq.com/en/research/php2shell-first-48-hours/"
    - "https://www.greynoise.io/"
    - "https://php.events.greynoise.io/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"http-ja4h","group":"Request fingerprints","cve_context":"CVE-2026-109618 / CVE-2026-109619 · campaign context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Fingerprint matches can include unrelated traffic. Preserve the full reported JA4H representation; do not substitute JA4 TLS hashes or a differently truncated JA4H.","provenance":"Grouped by evidence type and byte scope. Each member retains its matching predicate, source observations and limitations.","references":[{"label":"OffSeq — first 48 hours","url":"https://offseq.com/en/research/php2shell-first-48-hours/"},{"label":"GreyNoise","url":"https://www.greynoise.io/"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/"}],"members":[{"indicator":"ge11nn030000_52193b36b64e_000000000000_000000000000","field":"[JA4H_FIELD]","matchKind":"ja4h","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-ja4h-1"],"evidence":[{"id":"greynoise-event-ja4h-1","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","provenance":"JA4H GreyNoise recorded on confirmed exploitation sessions from 2.59.133.151.","context":"Find the HTTP fingerprint of a confirmed GreyNoise exploitation session.","limit":"Cookie-less JA4H values are coarse and match unrelated clients built with the same library. Correlate with multipart or upload-progress request evidence.","condition":{"field":"[JA4H_FIELD]","op":"eq","value":"ge11nn030000_52193b36b64e_000000000000_000000000000","ignoreCase":false},"references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"po10nn060000_efc8bc7e3e52_000000000000","field":"[JA4H_FIELD]","matchKind":"ja4h","sourceKeys":["offseq"],"aliases":["offseq-ja4h-1"],"evidence":[{"id":"offseq-ja4h-1","sourceKeys":["offseq"],"verification":"Referenced","date":"2026-10-20 / 2026-10-22","checked":"2026-10-23","provenance":"Exact JA4H value published by OffSeq.","context":"Find the OffSeq-reported lead actor HTTP fingerprint.","limit":"Map the same JA4H representation as the published value. Correlate with request anomalies; this is not a unique actor identity.","condition":{"field":"[JA4H_FIELD]","op":"eq","value":"po10nn060000_efc8bc7e3e52_000000000000","ignoreCase":false},"references":[{"label":"OffSeq — first 48 hours","url":"https://offseq.com/en/research/php2shell-first-48-hours/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"po10nn150000_94b423c72d17_000000000000","field":"[JA4H_FIELD]","matchKind":"ja4h","sourceKeys":["offseq"],"aliases":["offseq-ja4h-2"],"evidence":[{"id":"offseq-ja4h-2","sourceKeys":["offseq"],"verification":"Referenced","date":"2026-10-20 / 2026-10-22","checked":"2026-10-23","provenance":"Exact JA4H value published by OffSeq.","context":"Find the OffSeq-reported fasthttp cluster HTTP fingerprint.","limit":"Map the same JA4H representation as the published value. Correlate with request anomalies; this is not a unique actor identity.","condition":{"field":"[JA4H_FIELD]","op":"eq","value":"po10nn150000_94b423c72d17_000000000000","ignoreCase":false},"references":[{"label":"OffSeq — first 48 hours","url":"https://offseq.com/en/research/php2shell-first-48-hours/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"po11cn040000_0f012dde03cf_fe81d65a9ab0_2b5ca3dd2edc","field":"[JA4H_FIELD]","matchKind":"ja4h","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-ja4h-4"],"evidence":[{"id":"greynoise-event-ja4h-4","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","provenance":"JA4H GreyNoise recorded on confirmed exploitation sessions from 185.65.134.250.","context":"Find the HTTP fingerprint of a confirmed GreyNoise exploitation session.","limit":"Cookie-less JA4H values are coarse and match unrelated clients built with the same library. Correlate with multipart or upload-progress request evidence.","condition":{"field":"[JA4H_FIELD]","op":"eq","value":"po11cn040000_0f012dde03cf_fe81d65a9ab0_2b5ca3dd2edc","ignoreCase":false},"references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"po11nn040000_0f012dde03cf_000000000000_000000000000","field":"[JA4H_FIELD]","matchKind":"ja4h","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-ja4h-3"],"evidence":[{"id":"greynoise-event-ja4h-3","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","provenance":"JA4H GreyNoise recorded on confirmed exploitation sessions from 185.65.134.250.","context":"Find the HTTP fingerprint of a confirmed GreyNoise exploitation session.","limit":"Cookie-less JA4H values are coarse and match unrelated clients built with the same library. Correlate with multipart or upload-progress request evidence.","condition":{"field":"[JA4H_FIELD]","op":"eq","value":"po11nn040000_0f012dde03cf_000000000000_000000000000","ignoreCase":false},"references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"po11nn050000_c79a52b7736c_000000000000_000000000000","field":"[JA4H_FIELD]","matchKind":"ja4h","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-ja4h-2"],"evidence":[{"id":"greynoise-event-ja4h-2","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","provenance":"JA4H GreyNoise recorded on confirmed exploitation sessions from 2.59.133.151.","context":"Find the HTTP fingerprint of a confirmed GreyNoise exploitation session.","limit":"Cookie-less JA4H values are coarse and match unrelated clients built with the same library. Correlate with multipart or upload-progress request evidence.","condition":{"field":"[JA4H_FIELD]","op":"eq","value":"po11nn050000_c79a52b7736c_000000000000_000000000000","ignoreCase":false},"references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"}],"aliases":["offseq-ja4h-1","offseq-ja4h-2","greynoise-event-ja4h-1","greynoise-event-ja4h-2","greynoise-event-ja4h-3","greynoise-event-ja4h-4"]}
---
title: "PHP2Shell - Payload / C2 destination IPs (5)"
id: 98a03662-ea04-5b91-b9c5-d9afbd5aab04
name: php2shell_catalog_payload_destination_ips
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find outbound connections to reported payload-hosting and C2 destinations."
date: 2026-10-30
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[DESTINATION_IP_FIELD]|cased":
      - "2.59.133.151"
      - "92.118.112.100"
      - "117.55.202.115"
      - "134.199.154.64"
      - "206.245.153.56"
  condition: selection_1
falsepositives:
  - "Destination role only. Include failed connections; infrastructure can be reassigned."
level: low
references:
    - "https://www.greynoise.io/"
    - "https://php.events.greynoise.io/"
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
    - "https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619"
    - "https://blog.previdian.com/php2shell-activity-across-previdian-network/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"payload-destination-ips","group":"IP lists","cve_context":"CVE-2026-109618 / CVE-2026-109619 · reported campaign context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Destination role only. Include failed connections; infrastructure can be reassigned.","provenance":"Deduplicated by address and traffic role. Each address retains its original source observations, dates, verification and limitations.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/"},{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"},{"label":"Sophos — 22 October 21:21 UTC correction","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619"},{"label":"Previdian Research — PHP2Shell Activity Across Previdian Network, 28 October 2026","url":"https://blog.previdian.com/php2shell-activity-across-previdian-network/"}],"members":[{"indicator":"2.59.133.151","sourceKeys":["greynoise","greynoiseEvents","previdianResearch"],"aliases":["greynoise-event-dest-2-59-133-151","previdian-20261028-destination"],"evidence":[{"id":"greynoise-event-dest-2-59-133-151","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","provenance":"GreyNoise confirmed exploitation, 28–29 October 2026: the spawned shell ran curl to 37455255 (decimal 2.59.133.151) on TCP 7 and TCP 4, the attacker’s own address.","context":"Find outbound connections to the attacker address GreyNoise observed as a connect-back on TCP 7 and 4.","limit":"Destination role only. Include failed connections; command lines may use the decimal form 37455255.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]},{"id":"previdian-20261028-destination","sourceKeys":["previdianResearch"],"verification":"Referenced","date":"2026-10-28","checked":"2026-10-29","provenance":"Previdian Research, 28 October 2026, reports Apache shell execution on four honeypots. Local predicates and correlations are adaptations; command execution was observed but script retrieval and sleep execution were not.","context":"Find attempted outbound connections to the reported download infrastructure. TCP port 7 was observed; retain other ports for investigation.","limit":"Destination role is separate from inbound source evidence. Include failed connections; successful retrieval was not observed.","references":[{"label":"Previdian Research — PHP2Shell Activity Across Previdian Network, 28 October 2026","url":"https://blog.previdian.com/php2shell-activity-across-previdian-network/","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"92.118.112.100","sourceKeys":["cisa","cisaSigma","sophos"],"aliases":["cisa-payload-destinations"],"evidence":[{"id":"cisa-payload-destinations","sourceKeys":["cisa","cisaSigma","sophos"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"CISA lists these addresses; Sophos identifies their payload-hosting/C2 roles. Source-IP lists are unchanged.","context":"Find outbound connections to the payload host and Potassium infrastructure listed by CISA and Sophos.","limit":"Map the remote destination on outbound web-tier connections, not the inbound client IP. Addresses can be reassigned. Sophos corrected its assessment: customer attempts failed and the payload was not delivered.","references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"Sophos — 22 October 21:21 UTC correction","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"117.55.202.115","sourceKeys":["cisa","cisaSigma","sophos"],"aliases":["cisa-payload-destinations"],"evidence":[{"id":"cisa-payload-destinations","sourceKeys":["cisa","cisaSigma","sophos"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"CISA lists these addresses; Sophos identifies their payload-hosting/C2 roles. Source-IP lists are unchanged.","context":"Find outbound connections to the payload host and Potassium infrastructure listed by CISA and Sophos.","limit":"Map the remote destination on outbound web-tier connections, not the inbound client IP. Addresses can be reassigned. Sophos corrected its assessment: customer attempts failed and the payload was not delivered.","references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"Sophos — 22 October 21:21 UTC correction","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"134.199.154.64","sourceKeys":["cisa","cisaSigma","sophos"],"aliases":["cisa-payload-destinations"],"evidence":[{"id":"cisa-payload-destinations","sourceKeys":["cisa","cisaSigma","sophos"],"verification":"Referenced","date":null,"checked":"2026-10-25","provenance":"CISA lists these addresses; Sophos identifies their payload-hosting/C2 roles. Source-IP lists are unchanged.","context":"Find outbound connections to the payload host and Potassium infrastructure listed by CISA and Sophos.","limit":"Map the remote destination on outbound web-tier connections, not the inbound client IP. Addresses can be reassigned. Sophos corrected its assessment: customer attempts failed and the payload was not delivered.","references":[{"label":"CISA","url":"https://www.cisa.gov/","role":"Supporting reference"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml","role":"Supporting reference"},{"label":"Sophos — 22 October 21:21 UTC correction","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619","role":"Supporting reference"}]}],"verification":"Referenced"},{"indicator":"206.245.153.56","sourceKeys":["greynoise","greynoiseEvents"],"aliases":["greynoise-event-dest-206-245-153-56"],"evidence":[{"id":"greynoise-event-dest-206-245-153-56","sourceKeys":["greynoise","greynoiseEvents"],"verification":"Referenced","date":null,"checked":"2026-10-30","lastSeen":"2026-10-29","provenance":"GreyNoise confirmed exploitation, 29 October 2026: exploited sensors opened bash reverse shells to 206.245.153.56:42104, fetched /tools/collect.sh and /tools/deep-loot.sh from port 8088 and POSTed archives back to it. Moula World LLC, AS211019, Netherlands.","context":"Find outbound connections to the reverse-shell and tooling host reported by GreyNoise. Ports 42104 and 8088 were observed; retain other ports.","limit":"Destination role only. Include failed connections; infrastructure can be reassigned.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/","role":"Supporting reference"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/","role":"Supporting reference"}]}],"verification":"Referenced"}],"aliases":["greynoise-event-dest-206-245-153-56","ips-greynoise-greynoiseevents-destination-referenced","greynoise-event-dest-2-59-133-151","cisa-payload-destinations","ips-cisa-cisasigma-sophos-destination-referenced","previdian-20261028-destination","ips-previdianresearch-destination-referenced"]}
---
title: "PHP2Shell - PHP code in User-Agent header"
id: 2c64a862-ee5b-5da4-9aa8-3c88775fb442
name: php2shell_catalog_php_code_user_agent
status: experimental
author: "GreyNoise (greynoise.io); Sierra Echo Charlie (adaptation)"
description: "Find requests whose User-Agent carries a PHP open tag, as used to plant code through logged or session-stored headers."
date: 2026-10-30
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[USER_AGENT_FIELD]|re|i": "<\\?(?:php\\b|=)"
  condition: selection_1
falsepositives:
  - "Detects the planting attempt, not inclusion or execution. Generic log-poisoning scanners also match. Follow with session-file, PHP error and web-worker process review."
level: low
references:
    - "https://www.greynoise.io/"
    - "https://php.events.greynoise.io/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"php-code-user-agent","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"GreyNoise observed PHP2Shell sources sending eval(base64_decode($_POST[…])), shell_exec($_GET['lc']) and system(base64_decode(…)) payloads as User-Agents. The predicate is a local generalization.","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - GreyNoise PHP2Shell tag enrichment"
id: ceeddb53-4485-5fa1-9afe-1b7046f69e15
name: php2shell_catalog_greynoise_php2shell_tags
status: experimental
author: "GreyNoise (greynoise.io); Sierra Echo Charlie (adaptation)"
description: "Find inbound requests whose source IP carries a GreyNoise PHP2Shell exploit, session-poisoning or tooling tag."
date: 2026-10-30
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[GREYNOISE_TAG_FIELD]|cased":
      - "PHP CVE-2026-109618 Memory Corruption Exploit Attempt"
      - "PHP Request Memory Exhaustion Attempt"
      - "PHP Session Upload Progress Session Poisoning Attempt"
      - "PHP Session Upload Progress Activity"
      - "php2shell-Labeled Tooling"
  condition: selection_1
falsepositives:
  - "Enrichment reflects GreyNoise’s current view, not the time of the request. Activity and tooling tags are suspicious, not malicious; prioritize the three block-recommended tags."
level: low
references:
    - "https://www.greynoise.io/"
    - "https://php.events.greynoise.io/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"greynoise-php2shell-tags","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Tag names from the GreyNoise PHP2SHELL event page. Tag IDs: d3f0567e-8b87-46c1-9bfe-8ec577991b23, 31675f66-f478-4b59-ac4c-d221cba92c7d, f8745bed-1d32-48ca-bb5d-09cae6dcf0cf (block-recommended); 6349af21-d322-47b7-a7dc-b393c227a724, 4824289f-4ce4-4802-b8fc-2de11d25e1cd (suspicious).","references":[{"label":"GreyNoise","url":"https://www.greynoise.io/"},{"label":"GreyNoise PHP2SHELL Activity 2026 event page","url":"https://php.events.greynoise.io/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - PHP code in upload filename"
id: 443b30fc-0924-5333-a6dc-da0b1b319d5d
name: php2shell_catalog_php_upload_filename
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find PHP opening tags in an upload filename."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^multipart/form-data(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[UPLOAD_FILENAME_FIELD]|re|i": "<\\?(?:php\\b|=)"
  condition: (selection_1 and selection_2 and selection_3)
falsepositives:
  - "Use the decoded filename parameter, not file contents. Kibana uses the broader PHP-tag phrase and does not cover <?=."
level: low
references:
    - "https://previdian.com/"
    - "https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619"
    - "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"php-upload-filename","group":"Behavioral detections","cve_context":"CVE-2026-109618 · potential detection opportunity","optional_hunt":false,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Supplied Previdian export: 2 observations. CVE-specific effectiveness unconfirmed. Additional references reviewed 25 October 2026 support the signal or mechanism; local thresholds, matching details and CVE attribution retain their stated limitations.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json"},{"label":"Sophos — 22 October 21:21 UTC correction","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619"},{"label":"Arctic Wolf PHP2Shell observations","url":"https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Oversized upload filename"
id: c6461467-10a0-5b2e-9c67-9ce6a833b5f6
name: php2shell_catalog_oversized_upload_filename
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find unusually long upload filenames, including captured prefixes."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^multipart/form-data(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[MAX_UPLOAD_FILENAME_BYTES_FIELD]|gte": "[FILENAME_LENGTH_THRESHOLD_BYTES]"
  condition: (selection_1 and selection_2 and selection_3)
falsepositives:
  - "Map the largest decoded filename length in bytes, including truncated prefixes. Observed prefixes exceed 65,000 bytes; 4,096 is a candidate threshold, not a default."
level: low
references:
    - "https://previdian.com/"
    - "https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619"
    - "https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"oversized-upload-filename","group":"Behavioral detections","cve_context":"CVE-2026-109618 · potential detection opportunity","optional_hunt":false,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Supplied Previdian export: 2 observations. CVE-specific effectiveness unconfirmed. Additional references reviewed 25 October 2026 support the signal or mechanism; local thresholds, matching details and CVE attribution retain their stated limitations.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json"},{"label":"Sophos — 22 October 21:21 UTC correction","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Multipart field flood"
id: f4ff5f6b-d91d-5668-80a8-a0fae49cd5ae
name: php2shell_catalog_multipart_field_flood
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find requests containing unusually many named multipart form-data parts."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^multipart/form-data(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[MULTIPART_FIELD_COUNT_FIELD]|gte": "[MULTIPART_FIELD_COUNT_THRESHOLD]"
  condition: (selection_1 and selection_2 and selection_3)
falsepositives:
  - "Count named form-data parts per request, including file parts, not headers within a part; verify that your parser exposes this definition. Captures show 584–990 fields; 500 is a candidate threshold requiring local tuning. Upload-progress is deliberately not required."
level: low
references:
    - "https://previdian.com/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"multipart-field-flood","group":"Behavioral detections","cve_context":"CVE-2026-109618 · potential detection opportunity","optional_hunt":false,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Supplied Previdian export: 4 observations. CVE-specific effectiveness unconfirmed.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Path-like session ID in upload request"
id: acaae272-a055-5e4a-8d42-7a20c9cf1607
name: php2shell_catalog_session_id_path
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find path separators in a submitted PHPSESSID form value alongside upload-progress."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^multipart/form-data(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[HAS_UPLOAD_PROGRESS_FIELD]": true
  selection_4:
    "[FORM_PHPSESSID_FIELD]|re": "[/\\\\]"
  condition: (selection_1 and selection_2 and selection_3 and selection_4)
falsepositives:
  - "Use the decoded PHPSESSID form value from the same request. Observed value: vuln/AAAA1111BBBB2222CCCC3333DDDD."
level: low
references:
    - "https://previdian.com/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"session-id-path","group":"Behavioral detections","cve_context":"CVE-2026-109618 · potential detection opportunity","optional_hunt":false,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Supplied Previdian export: 2 observations. CVE-specific effectiveness unconfirmed.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - B8RAT request fingerprint"
id: acbdbceb-e8a1-5494-980e-cb72b6e639a1
name: php2shell_catalog_hunt_b8rat
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find the observed B8RAT-labelled upload request pattern."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^multipart/form-data(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[USER_AGENT_FIELD]|contains|cased": "B8RAT/1.0"
  selection_4:
    "[UPLOAD_PROGRESS_VALUE_FIELD]|cased": "|x|i:1;"
  condition: (selection_1 and selection_2 and selection_3 and selection_4)
falsepositives:
  - "Optional hunt. Request fingerprint only; the user-agent label does not establish malware attribution."
level: low
references:
    - "https://previdian.com/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"hunt-b8rat","group":"Request fingerprints","cve_context":"CVE-2026-109618 · potential detection opportunity","optional_hunt":true,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Supplied Previdian export: 7 observations. CVE-specific effectiveness unconfirmed.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - P2SMK request fingerprint"
id: 3804e355-5cbe-57f4-aa40-0c1221e739a2
name: php2shell_catalog_hunt_p2smk
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find upload-progress values beginning P2SMK followed by ten lowercase letters."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^multipart/form-data(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[UPLOAD_PROGRESS_VALUE_FIELD]|re": "^P2SMK[a-z]{10}$"
  condition: (selection_1 and selection_2 and selection_3)
falsepositives:
  - "Optional hunt. Kibana uses a broader prefix search; other parsed-log formats enforce the full pattern."
level: low
references:
    - "https://previdian.com/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"hunt-p2smk","group":"Request fingerprints","cve_context":"CVE-2026-109618 · potential detection opportunity","optional_hunt":true,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Supplied Previdian export: 2 observations. CVE-specific effectiveness unconfirmed.","references":[{"label":"Previdian — supplied observations, 21–22 October 2026","url":"https://previdian.com/","document":"CVE-2026-109618-observations.json"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - PHP session decode failure"
id: a73bfe6a-5961-5068-a69f-bb3a0b44cdab
name: php2shell_catalog_session_decode
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find failed session decoding in PHP diagnostics."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[MESSAGE_FIELD]|re|i": "\\bFailed[ \\t]+to[ \\t]+decode[ \\t]+session[ \\t]+object\\b"
  condition: selection_1
falsepositives:
  - "Session corruption and serializer changes also cause this warning. CVE-specific sequence is unconfirmed."
level: low
references:
    - "https://github.com/php/php-src/blob/PHP-8.4.4/ext/session/session.c"
    - "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"session-decode","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"CVE-specific interpretation unconfirmed. Primary references describe the diagnostic or underlying mechanism.","references":[{"label":"PHP session diagnostic","url":"https://github.com/php/php-src/blob/PHP-8.4.4/ext/session/session.c"},{"label":"PHP advisory: CVE-2026-109619","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - PHP-FPM child SIGSEGV"
id: 04960da0-8723-5202-94e6-fc3c4b6bca3c
name: php2shell_catalog_fpm_segv
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find FPM children terminated by SIGSEGV."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[MESSAGE_FIELD]|re|i": "\\bchild[ \\t]+[0-9]+[ \\t]+exited[ \\t]+on[ \\t]+signal[ \\t]+11[ \\t]+\\(SIGSEGV\\)"
  condition: selection_1
falsepositives:
  - "Worker crash signal; faulty extensions can produce the same event. Select the FPM master log."
level: low
references:
    - "https://github.com/php/php-src/blob/PHP-8.4/sapi/fpm/fpm/fpm_children.c"
    - "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"fpm-segv","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"CVE-specific interpretation unconfirmed. Primary references describe the diagnostic or underlying mechanism.","references":[{"label":"PHP-FPM child exit logging","url":"https://github.com/php/php-src/blob/PHP-8.4/sapi/fpm/fpm/fpm_children.c"},{"label":"PHP advisory: CVE-2026-109619","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - PHP-FPM child exit code 70"
id: 5dc6f736-48e2-5252-b3a9-61d063d121bf
name: php2shell_catalog_fpm_exit70
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find FPM children exiting with code 70."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[MESSAGE_FIELD]|re|i": "\\bchild[ \\t]+[0-9]+[ \\t]+exited[ \\t]+with[ \\t]+code[ \\t]+70\\b"
  condition: selection_1
falsepositives:
  - "Exit-code context only. The cause and CVE association are unconfirmed; correlate with PHP diagnostics."
level: low
references:
    - "https://github.com/php/php-src/blob/PHP-8.4/sapi/fpm/fpm/fpm_children.c"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"fpm-exit70","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"CVE-specific interpretation unconfirmed. Primary references describe the diagnostic or underlying mechanism.","references":[{"label":"PHP-FPM child exit logging","url":"https://github.com/php/php-src/blob/PHP-8.4/sapi/fpm/fpm/fpm_children.c"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - nginx upstream closed before response headers"
id: 615c54e1-bc63-51bf-b3e2-aba0a827cad3
name: php2shell_catalog_nginx_upstream
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find PHP upstream connections closed before response headers."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[MESSAGE_FIELD]|re|i": "\\bupstream prematurely closed connection[^\\r\\n]*\\bwhile reading response header\\b"
  condition: selection_1
falsepositives:
  - "Generic upstream failure. Scope to PHP upstreams; an HTTP status alone does not identify the cause."
level: low
references:
    - "https://github.com/nginx/nginx/blob/master/src/http/ngx_http_upstream.c"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"nginx-upstream","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"CVE-specific interpretation unconfirmed. Primary references describe the diagnostic or underlying mechanism.","references":[{"label":"nginx upstream diagnostics","url":"https://github.com/nginx/nginx/blob/master/src/http/ngx_http_upstream.c"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Apache FastCGI dispatch failure"
id: a74a93c4-e01f-50a3-9819-953cb4633604
name: php2shell_catalog_apache_fcgi
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find FastCGI request dispatch failures."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[MESSAGE_FIELD]|re|i": "\\bAH01075:[^\\r\\n]*\\bError dispatching request\\b"
  condition: selection_1
falsepositives:
  - "Generic FastCGI error; select PHP backends and correlate with worker diagnostics."
level: low
references:
    - "https://github.com/apache/httpd/blob/trunk/modules/proxy/mod_proxy_fcgi.c"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"apache-fcgi","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"CVE-specific interpretation unconfirmed. Primary references describe the diagnostic or underlying mechanism.","references":[{"label":"Apache FastCGI diagnostics","url":"https://github.com/apache/httpd/blob/trunk/modules/proxy/mod_proxy_fcgi.c"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Session unserializer crash frames"
id: 5958e91d-dae8-535e-aa2d-f20ec827167f
name: php2shell_catalog_unserializer_crash
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find session-unserializer symbols together in one PHP crash report."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[IS_PHP_PROCESS_FIELD]": true
  selection_2:
    "[STACK_TRACE_FIELD]|contains|cased": "tmp_var"
  selection_3:
    "[STACK_TRACE_FIELD]|contains|cased": "var_unserializer.c"
  selection_4:
    "[STACK_TRACE_FIELD]|contains|cased": "php_session_decode"
  condition: (selection_1 and selection_2 and selection_3 and selection_4)
falsepositives:
  - "Requires debug symbols and a single assembled crash report. This frame combination is unconfirmed as a CVE-specific signature."
level: low
references:
    - "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
    - "https://www.wiz.io/blog/php2shell-php-rce"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"unserializer-crash","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"CVE-specific interpretation unconfirmed. Primary references describe the diagnostic or underlying mechanism. Additional references reviewed 25 October 2026 support the signal or mechanism; local thresholds, matching details and CVE attribution retain their stated limitations.","references":[{"label":"PHP advisory: CVE-2026-109619","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"},{"label":"Wiz PHP2Shell technical analysis","url":"https://www.wiz.io/blog/php2shell-php-rce"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Chunked multipart POST"
id: 74a47df7-e29a-5692-b486-dae296aba4ab
name: php2shell_catalog_chunked_multipart
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find multipart POST requests using chunked transfer encoding."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^multipart/form-data(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[TRANSFER_ENCODING_FIELD]|re|i": "(?:^|,)[ \\t]*chunked[ \\t]*(?:,|$)"
  condition: (selection_1 and selection_2 and selection_3)
falsepositives:
  - "Legitimate streaming uploads also match. Covers the HTTP/1.x chunked case; HTTP/2 lengthless bodies need separate accounting."
level: low
references:
    - "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"chunked-multipart","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Underlying multipart limit behavior described in the PHP advisory. Threshold and query are local detection choices.","references":[{"label":"PHP advisory: CVE-2026-109618","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Many empty upload filenames"
id: 24ed8735-a74c-5dad-a74f-312cb1fa1e75
name: php2shell_catalog_empty_filenames
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find requests with unusually many empty upload filenames."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^multipart/form-data(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[EMPTY_FILENAME_COUNT_FIELD]|gte": "[EMPTY_FILENAME_COUNT_THRESHOLD]"
  condition: (selection_1 and selection_2 and selection_3)
falsepositives:
  - "Choose the threshold against expected forms. Count file parts with an empty filename, not all blank form values."
level: low
references:
    - "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
    - "https://www.peakhour.io/blog/php2shell-upload-probes/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"empty-filenames","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Underlying multipart limit behavior described in the PHP advisory. Threshold and query are local detection choices. Additional references reviewed 25 October 2026 support the signal or mechanism; local thresholds, matching details and CVE attribution retain their stated limitations.","references":[{"label":"PHP advisory: CVE-2026-109618","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"},{"label":"Peakhour upload-probe observations","url":"https://www.peakhour.io/blog/php2shell-upload-probes/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - PHP worker creates a memfd"
id: 8b9a99d7-5fa3-5698-a17b-1ab9f0b8f919
name: php2shell_catalog_worker_memfd_create
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find successful memfd creation by a web worker."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[PROCESS_BASENAME_FIELD]|re|i": "^(?:apache2|httpd|nginx|frankenphp|php(?:[0-9]+(?:\\.[0-9]+)*)?|php-fpm(?:[0-9]+(?:\\.[0-9]+)*)?|php-cgi(?:[0-9]+(?:\\.[0-9]+)*)?|lsphp[0-9]*)$"
  selection_2:
    "[SYSCALL_NAME_FIELD]|cased": "memfd_create"
  selection_3:
    "[SYSCALL_SUCCESS_FIELD]": true
  condition: (selection_1 and selection_2 and selection_3)
falsepositives:
  - "Creation alone is not execution. Extensions and runtime components may legitimately use memfd."
level: low
references:
    - "https://falco.org/docs/reference/rules/supported-fields/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"worker-memfd-create","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"CVE-specific interpretation unconfirmed. Primary references describe the diagnostic or underlying mechanism.","references":[{"label":"Falco process fields","url":"https://falco.org/docs/reference/rules/supported-fields/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Web-worker child executes from memfd"
id: 0ff19f82-ed21-5d72-80a9-7caf72c68eff
name: php2shell_catalog_worker_memfd_exec
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find web-worker children executing from anonymous memfd files."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[PARENT_BASENAME_FIELD]|re|i": "^(?:apache2|httpd|nginx|frankenphp|php(?:[0-9]+(?:\\.[0-9]+)*)?|php-fpm(?:[0-9]+(?:\\.[0-9]+)*)?|php-cgi(?:[0-9]+(?:\\.[0-9]+)*)?|lsphp[0-9]*)$"
  selection_2:
    "[EXEC_SUCCESS_FIELD]": true
  selection_3:
    "[IS_EXE_FROM_MEMFD_FIELD]": true
  condition: (selection_1 and selection_2 and selection_3)
falsepositives:
  - "Uses the executable backing-file flag, not a memfd-looking command line. CVE attribution requires request correlation."
level: low
references:
    - "https://falco.org/docs/reference/rules/supported-fields/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"worker-memfd-exec","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"CVE-specific interpretation unconfirmed. Primary references describe the diagnostic or underlying mechanism.","references":[{"label":"Falco process fields","url":"https://falco.org/docs/reference/rules/supported-fields/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - AWS WAF PHP2Shell matches"
id: 9b8adf42-ad7d-5809-bc9f-53db10d21b66
name: php2shell_catalog_aws_waf_php2shell
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find AWS managed PHP2Shell rule matches, including block and count mode."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[WAF_LABEL_FIELD]|cased":
      - "awswaf:managed:aws:php-app:PHP2Shell_Body"
      - "awswaf:managed:aws:php-app:PHP2Shell_Body_Extended"
  condition: selection_1
falsepositives:
  - "Expand labels[].name to one scalar WAF_LABEL per label before querying. Retain request ID, web ACL, timestamp, action and ruleGroupList; deduplicate requests matching both labels. No action filter is applied. Rules available depend on the managed-rule version; body inspection limits still apply."
level: low
references:
    - "https://aws.amazon.com/blogs/security/using-aws-waf-to-apply-mitigations-for-php2shell-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/"
    - "https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-use-case.html"
    - "https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"aws-waf-php2shell","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · detection opportunity","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Expand labels[].name to one scalar WAF_LABEL per label before querying. Retain request ID, web ACL, timestamp, action and ruleGroupList; deduplicate requests matching both labels. No action filter is applied. Rules available depend on the managed-rule version; body inspection limits still apply.","provenance":"AWS documents PHP2Shell_BODY and PHP2Shell_BODY_Extended and their exact labels. AWS WAF logging records request labels regardless of the final request action.","references":[{"label":"AWS WAF PHP2Shell mitigations","url":"https://aws.amazon.com/blogs/security/using-aws-waf-to-apply-mitigations-for-php2shell-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/"},{"label":"AWS PHP managed rules and labels","url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-use-case.html"},{"label":"AWS WAF log fields","url":"https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Serialized CachedData in cook form value"
id: 0488b9d2-0701-5d34-b0d7-db94d4b1c38d
name: php2shell_catalog_hunt_telekom_cacheddata
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find URL-encoded POSTs with serialized CachedData and NUL bytes in the cook form value."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^application/x-www-form-urlencoded(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[FORM_NAME_FIELD]|cased": "cook"
  selection_4:
    "[FORM_VALUE_FIELD]|re": "^a:[0-9]+:\\{[\\s\\S]*CachedData"
  selection_5:
    "[FORM_VALUE_HAS_NUL_FIELD]": true
  condition: (selection_1 and selection_2 and selection_3 and selection_4 and selection_5)
falsepositives:
  - "Use one event per form-field instance. FORM_VALUE and FORM_VALUE_HAS_NUL must describe the same cook value after form decoding; NUL means byte 0x00, not the literal text \\x00. Do not deserialize the value. Kibana uses a broader CachedData phrase match. CVE attribution and outcome remain unconfirmed."
level: low
references:
    - "https://github.security.telekom.com/2026/10/php2shell-honeypot-observations.html"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"hunt-telekom-cacheddata","group":"Optional hunts","cve_context":"CVE-2026-109618 / CVE-2026-109619 · detection opportunity","optional_hunt":true,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Use one event per form-field instance. FORM_VALUE and FORM_VALUE_HAS_NUL must describe the same cook value after form decoding; NUL means byte 0x00, not the literal text \\x00. Do not deserialize the value. Kibana uses a broader CachedData phrase match. CVE attribution and outcome remain unconfirmed.","provenance":"Telekom observed serialized arrays containing CachedData and raw NULs in cook POST values on 21 October. It could not establish whether they targeted either CVE or succeeded.","references":[{"label":"Telekom Security honeypot observations","url":"https://github.security.telekom.com/2026/10/php2shell-honeypot-observations.html"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Binary data in an empty-name form field"
id: 31c0b64e-6107-567b-ac0a-3d974915cba3
name: php2shell_catalog_binary_empty_form_value
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find URL-encoded POSTs with null or unexpected control bytes in an empty-name field value."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^application/x-www-form-urlencoded(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[EMPTY_NAME_VALUE_HAS_CONTROL_BYTES_FIELD]": true
  condition: (selection_1 and selection_2 and selection_3)
falsepositives:
  - "Derive the flag from values belonging to empty-name fields only, after form decoding. Match null or C0 controls excluding tab, CR and LF; do not scan the entire request or match a literal backslash-x00 string. Retain raw bytes for review. Long field names are covered separately."
level: low
references:
    - "https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"binary-empty-form-value","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · detection opportunity","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Derive the flag from values belonging to empty-name fields only, after form decoding. Match null or C0 controls excluding tab, CR and LF; do not scan the entire request or match a literal backslash-x00 string. Retain raw bytes for review. Long field names are covered separately.","provenance":"Source describes the observation or detection approach; thresholds and correlation logic are local template choices.","references":[{"label":"Datadog PHP2Shell analysis","url":"https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Corelight suspicious session sequence"
id: f980ac2e-c53b-52d8-894c-190bd2645352
name: php2shell_catalog_corelight_crash_sequence
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find PHP2SHELL::PHP_Crash_Sequence notices for related suspicious HTTP transactions in one session."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[NOTICE_TYPE_FIELD]|cased": "PHP2SHELL::PHP_Crash_Sequence"
  condition: selection_1
falsepositives:
  - "Requires the Corelight analyzer. The notice describes an HTTP transaction sequence, not confirmation of a host process crash."
level: low
references:
    - "https://github.com/corelight/php2shell-detect"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"corelight-crash-sequence","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · detection opportunity","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Requires the Corelight analyzer. The notice describes an HTTP transaction sequence, not confirmation of a host process crash.","provenance":"Source describes the observation or detection approach; thresholds and correlation logic are local template choices.","references":[{"label":"Corelight Zeek / Suricata package","url":"https://github.com/corelight/php2shell-detect"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Web worker creates an unusual executable web file"
id: 90471456-91c6-598c-98f2-0de889cb01d0
name: php2shell_catalog_worker_unusual_web_file
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find web workers creating web-executable files at unusual paths or with high entropy."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[WRITER_BASENAME_FIELD]|re|i": "^(?:apache2|httpd|nginx|frankenphp|php(?:[0-9]+(?:\\.[0-9]+)*)?|php-fpm(?:[0-9]+(?:\\.[0-9]+)*)?|php-cgi(?:[0-9]+(?:\\.[0-9]+)*)?|lsphp[0-9]*)$"
  selection_2:
    "[FILE_EVENT_ACTION_FIELD]|cased": "[FILE_CREATE_ACTION]"
  selection_3:
    "[IS_WEB_EXECUTABLE_FIELD]": true
  selection_4:
    "[UNUSUAL_FILE_PATH_FIELD]": true
  selection_5:
    "[FILE_ENTROPY_FIELD]|gte": "[ENTROPY_THRESHOLD]"
  condition: (selection_1 and selection_2 and selection_3 and (selection_4 or selection_5))
falsepositives:
  - "Map web-executable extensions using the serving configuration. UNUSUAL_FILE_PATH is a baseline-derived flag, not merely a new filename. Entropy requires file-content telemetry; missing entropy can still match the unusual-path branch. Tune for deployments and caches."
level: low
references:
    - "https://www.elastic.co/security-labs/threat-command/php2shell-php-rce-detection"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"worker-unusual-web-file","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · detection opportunity","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Map web-executable extensions using the serving configuration. UNUSUAL_FILE_PATH is a baseline-derived flag, not merely a new filename. Entropy requires file-content telemetry; missing entropy can still match the unusual-path branch. Tune for deployments and caches.","provenance":"Source describes the observation or detection approach; thresholds and correlation logic are local template choices.","references":[{"label":"Elastic PHP2Shell detection coverage","url":"https://www.elastic.co/security-labs/threat-command/php2shell-php-rce-detection"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Deeply nested form names"
id: 85770f4e-bf2e-5701-9b44-ea4ab036b12e
name: php2shell_catalog_deep_form_nesting
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find multipart form names with unusually deep bracket nesting."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^multipart/form-data(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[MAX_FORM_NAME_DEPTH_FIELD]|gte": "[NESTING_DEPTH_THRESHOLD]"
  condition: (selection_1 and selection_2 and selection_3)
falsepositives:
  - "Derive maximum bracket nesting in one decoded field name, not the total brackets across the request. Set the threshold against expected forms."
level: low
references:
    - "https://offseq.com/en/research/php2shell-first-48-hours/"
    - "https://www.vulncheck.com/blog/php2shell-vulnerabilities"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"deep-form-nesting","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · detection opportunity","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Source describes the observation or detection approach; thresholds and correlation logic are local template choices. Additional references reviewed 25 October 2026 support the signal or mechanism; local thresholds, matching details and CVE attribution retain their stated limitations.","references":[{"label":"OffSeq — first 48 hours","url":"https://offseq.com/en/research/php2shell-first-48-hours/"},{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Windows web worker starts an unexpected command"
id: 00df671d-6603-59af-95b3-c40549a6fbc5
name: php2shell_catalog_windows_worker_command
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find Windows PHP or Apache workers launching command interpreters, reconnaissance or execution utilities."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[PARENT_BASENAME_FIELD]|re|i": "^(?:php|php-cgi|httpd|apache|apache2|frankenphp)\\.exe$"
  selection_2:
    "[PROCESS_BASENAME_FIELD]|re|i": "^(?:cmd|powershell|pwsh|net|net1|certutil|rundll32|wmic|whoami|hostname)\\.exe$"
  condition: (selection_1 and selection_2)
falsepositives:
  - "Map executable basenames, not full paths. Exclude expected application subprocesses."
level: low
references:
    - "https://www.nextron-systems.com/2026/10/22/php2shell-detection-coverage-in-thor/"
    - "https://github.com/SigmaHQ/sigma/pull/6506"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"windows-worker-command","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · detection opportunity","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Source describes the observation or detection approach; thresholds and correlation logic are local template choices.","references":[{"label":"Nextron PHP2Shell coverage","url":"https://www.nextron-systems.com/2026/10/22/php2shell-detection-coverage-in-thor/"},{"label":"SigmaHQ proposal 6506 (review pending)","url":"https://github.com/SigmaHQ/sigma/pull/6506"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Boundary fragment in session-path error"
id: 4f980471-83c1-5d8d-80e5-5090c26a538b
name: php2shell_catalog_hunt_session_boundary_path
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find session file-open failures with /ndary= in the attempted path."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[MESSAGE_FIELD]|re|i": "session_start\\(\\):[ \\t]*open\\([^\\r\\n]*/ndary=[^\\r\\n]*\\)[^\\r\\n]*failed"
  condition: selection_1
falsepositives:
  - "Candidate pattern from an upstream proposal still under review. Kibana phrase matching is broader than the regex."
level: low
references:
    - "https://github.com/SigmaHQ/sigma/pull/6506"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"hunt-session-boundary-path","group":"Optional hunts","cve_context":"CVE-2026-109618 / CVE-2026-109619 · detection opportunity","optional_hunt":true,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Source describes the observation or detection approach; thresholds and correlation logic are local template choices.","references":[{"label":"SigmaHQ proposal 6506 (review pending)","url":"https://github.com/SigmaHQ/sigma/pull/6506"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - B7kQpoc618 multipart boundary"
id: f5a217b5-ffab-585a-92e8-c470b6c7311a
name: php2shell_catalog_hunt_b7k_boundary
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find multipart POST requests using the reported B7kQpoc618 boundary."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^multipart/form-data(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[MULTIPART_BOUNDARY_FIELD]|cased": "B7kQpoc618"
  condition: (selection_1 and selection_2 and selection_3)
falsepositives:
  - "Map the parsed boundary parameter without surrounding quotes or delimiter hyphens. Exact tool fingerprint only."
level: low
references:
    - "https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619"
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
    - "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
    - "https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"hunt-b7k-boundary","group":"Request fingerprints","cve_context":"CVE-2026-109618 / CVE-2026-109619 · detection opportunity","optional_hunt":true,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Map the parsed boundary parameter without surrounding quotes or delimiter hyphens. Exact tool fingerprint only.","provenance":"Source describes the observation or detection approach; thresholds and correlation logic are local template choices. Additional references reviewed 25 October 2026 support the signal or mechanism; local thresholds, matching details and CVE attribution retain their stated limitations.","references":[{"label":"Sophos — 22 October 21:21 UTC correction","url":"https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619"},{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"},{"label":"Arctic Wolf PHP2Shell observations","url":"https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - PHP-FPM child SIGABRT"
id: 6ea5f43b-284a-5e75-8de7-9cb65fa0556e
name: php2shell_catalog_fpm_abort
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find PHP-FPM children terminated by SIGABRT (signal 6)."
date: 2026-10-23
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[MESSAGE_FIELD]|re|i": "\\bchild[ \\t]+[0-9]+[ \\t]+exited[ \\t]+on[ \\t]+signal[ \\t]+6[ \\t]+\\(SIGABRT\\)"
  condition: selection_1
falsepositives:
  - "Worker abort signal; correlate with request and PHP diagnostics."
level: low
references:
    - "https://graylog.org/post/detecting-php2shell-cves-with-graylog/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"fpm-abort","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · detection opportunity","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Source describes the observation or detection approach; thresholds and correlation logic are local template choices.","references":[{"label":"Graylog PHP2Shell detections","url":"https://graylog.org/post/detecting-php2shell-cves-with-graylog/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Excessive multipart field-name byte length"
id: 206df4c0-b24d-53b6-9b4a-27807bcf5630
name: php2shell_catalog_multipart_long_field_name
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find multipart POSTs with an unusually long individual decoded form-field name."
date: 2026-10-26
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^multipart/form-data(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[MAX_MULTIPART_FIELD_NAME_BYTES_FIELD]|gte": "[MULTIPART_NAME_BYTES_THRESHOLD]"
  condition: (selection_1 and selection_2 and selection_3)
falsepositives:
  - "Tune [MULTIPART_NAME_BYTES_THRESHOLD] against legitimate forms. Count name bytes, not Unicode characters, field values, whole-body bytes or URL-encoded wire bytes. Incomplete inspection can miss or undercount names. Large machine-generated forms may match."
level: low
references:
    - "https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/stealmybitcoin_poc.py"
    - "https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/README.md#what-each-request-does"
x_sec: {"catalog_id":"multipart-long-field-name","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context, not attribution","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"The PoC constructs a very long multipart name. This thresholded decoded-name metric is a proposed generic heuristic; the existing Corelight URL-encoded form-key notice does not cover it.","references":[{"label":"Steal My Bitcoin PoC — request construction and sequence","url":"https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/stealmybitcoin_poc.py"},{"label":"Steal My Bitcoin PoC — request walkthrough","url":"https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/README.md#what-each-request-does"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Excessive or malformed request cookies"
id: 8ff9f6a5-a76f-52ce-90d0-6d50817f004b
name: php2shell_catalog_request_cookie_anomaly
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find requests with many distinct cookie pairs plus empty values or a large Cookie header, or a parser-confirmed malformed cookie structure."
date: 2026-10-26
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[DISTINCT_REQUEST_COOKIE_PAIRS_FIELD]|gte": "[COOKIE_PAIR_COUNT_THRESHOLD]"
  selection_2:
    "[EMPTY_REQUEST_COOKIE_PAIRS_FIELD]|gte": "[EMPTY_COOKIE_PAIR_COUNT_THRESHOLD]"
  selection_3:
    "[REQUEST_COOKIE_HEADER_BYTES_FIELD]|gte": "[COOKIE_HEADER_BYTES_THRESHOLD]"
  selection_4:
    "[REQUEST_COOKIE_MALFORMED_FIELD]": true
  condition: ((selection_1 and (selection_2 or selection_3)) or selection_4)
falsepositives:
  - "Count pairs across all Cookie lines, never header lines; deduplicate identical pairs before the distinct count. Tune count and byte thresholds for proxies and applications with many cookies. Rejected or truncated headers can hide pairs. Parser quirks and legitimate state-heavy applications cause false positives."
level: low
references:
    - "https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/stealmybitcoin_poc.py"
    - "https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/README.md#what-each-request-does"
x_sec: {"catalog_id":"request-cookie-anomaly","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context, not attribution","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"The PoC sends many distinct empty-valued request cookies. Count, concentration, size and malformed-structure branches are proposed generic heuristics, not observed exploit-specific constants.","references":[{"label":"Steal My Bitcoin PoC — request construction and sequence","url":"https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/stealmybitcoin_poc.py"},{"label":"Steal My Bitcoin PoC — request walkthrough","url":"https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/README.md#what-each-request-does"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Invalid decoded session ID in multipart form"
id: 88d07b84-950d-5b8a-b69a-87ebe0f8f16b
name: php2shell_catalog_invalid_form_session_id
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find decoded PHP session-ID form values containing NUL or disallowed control bytes, or failing the deployment’s configured session-ID grammar."
date: 2026-10-26
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^multipart/form-data(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[FORM_SESSION_ID_HAS_INVALID_CONTROL_FIELD]": true
  selection_4:
    "[FORM_SESSION_ID_INVALID_STRUCTURE_FIELD]": true
  condition: (selection_1 and selection_2 and (selection_3 or selection_4))
falsepositives:
  - "Control bytes include NUL; define the disallowed byte set and valid grammar from local PHP/session configuration. Inspect decoded bytes, not literal backslash escapes. This is a form value, not a Cookie request value or Set-Cookie response. Benign malformed clients may match; missing/truncated body parsing misses them."
level: low
references:
    - "https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/stealmybitcoin_poc.py"
    - "https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/README.md#what-each-request-does"
x_sec: {"catalog_id":"invalid-form-session-id","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context, not attribution","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"The PoC places a NUL in its PHPSESSID multipart form value. The invalid-byte and locally configured grammar checks are proposed heuristics; acceptance depends on the target’s session configuration.","references":[{"label":"Steal My Bitcoin PoC — request construction and sequence","url":"https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/stealmybitcoin_poc.py"},{"label":"Steal My Bitcoin PoC — request walkthrough","url":"https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/README.md#what-each-request-does"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - CISA PHP2Shell keyword hunt"
id: f0215724-5a8f-527c-ac77-bd686b5ac44a
name: php2shell_catalog_hunt_cisa_keywords
status: experimental
author: "CISA (cisa.gov), Sierra Echo Charlie (adaptation)"
description: "Search one complete event for any of CISA’s five PHP2Shell keyword branches: request shape, upload-progress with command text, fatal memory error, PHP code tokens, or a reported indicator."
date: 2026-10-25
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[EVENT_TEXT_FIELD]|contains": "POST"
  selection_2:
    "[EVENT_TEXT_FIELD]|contains": "index.php"
  selection_3:
    "[EVENT_TEXT_FIELD]|contains": "PHPSESSID"
  selection_4:
    "[EVENT_TEXT_FIELD]|contains": "PHP_SESSION_UPLOAD_PROGRESS"
  selection_5:
    "[EVENT_TEXT_FIELD]|contains": "php2shell"
  selection_6:
    "[EVENT_TEXT_FIELD]|contains": "B7kQpoc61"
  selection_7:
    "[EVENT_TEXT_FIELD]|contains": "BNDRY12345"
  selection_8:
    "[EVENT_TEXT_FIELD]|contains": "filename"
  selection_9:
    "[EVENT_TEXT_FIELD]|contains": "multipart/form-data"
  selection_10:
    "[EVENT_TEXT_FIELD]|contains": "Content-Disposition: form-data"
  selection_11:
    "[EVENT_TEXT_FIELD]|contains": "application/x-www-form-urlencoded"
  selection_12:
    "[EVENT_TEXT_FIELD]|contains": "aaaaaaaaaaa"
  selection_13:
    "[EVENT_TEXT_FIELD]|contains": "AAAAAAAAAAA"
  selection_14:
    "[EVENT_TEXT_FIELD]|contains": "bbbbbbbbbbb"
  selection_15:
    "[EVENT_TEXT_FIELD]|contains": "BBBBBBBBBBB"
  selection_16:
    "[EVENT_TEXT_FIELD]|contains": "VVVVVVVVVVV"
  selection_17:
    "[EVENT_TEXT_FIELD]|contains": "SSSSSSSSSSS"
  selection_18:
    "[EVENT_TEXT_FIELD]|contains": "ppppppppppp"
  selection_19:
    "[EVENT_TEXT_FIELD]|contains": "pwn"
  selection_20:
    "[EVENT_TEXT_FIELD]|contains": "PHP_SESSION_UPLOAD_PROGRESS"
  selection_21:
    "[EVENT_TEXT_FIELD]|contains": "php-cgi"
  selection_22:
    "[EVENT_TEXT_FIELD]|contains": "apache2"
  selection_23:
    "[EVENT_TEXT_FIELD]|contains": "httpd"
  selection_24:
    "[EVENT_TEXT_FIELD]|contains": "php-fpm"
  selection_25:
    "[EVENT_TEXT_FIELD]|contains": "mod-php"
  selection_26:
    "[EVENT_TEXT_FIELD]|contains": "/bin/sh"
  selection_27:
    "[EVENT_TEXT_FIELD]|contains": "/bin/bash"
  selection_28:
    "[EVENT_TEXT_FIELD]|contains": "cmd"
  selection_29:
    "[EVENT_TEXT_FIELD]|contains": "powershell"
  selection_30:
    "[EVENT_TEXT_FIELD]|contains": "python"
  selection_31:
    "[EVENT_TEXT_FIELD]|contains": "curl"
  selection_32:
    "[EVENT_TEXT_FIELD]|contains": "wget"
  selection_33:
    "[EVENT_TEXT_FIELD]|contains": "netcat"
  selection_34:
    "[EVENT_TEXT_FIELD]|contains": "nc"
  selection_35:
    "[EVENT_TEXT_FIELD]|contains": "whoami"
  selection_36:
    "[EVENT_TEXT_FIELD]|contains": "id"
  selection_37:
    "[EVENT_TEXT_FIELD]|contains": "uname "
  selection_38:
    "[EVENT_TEXT_FIELD]|contains": "PHP Fatal error:"
  selection_39:
    "[EVENT_TEXT_FIELD]|contains": "Allowed memory"
  selection_40:
    "[EVENT_TEXT_FIELD]|contains": " in Unknown "
  selection_41:
    "[EVENT_TEXT_FIELD]|contains": "<"
  selection_42:
    "[EVENT_TEXT_FIELD]|contains": "php"
  selection_43:
    "[EVENT_TEXT_FIELD]|contains": "echo"
  selection_44:
    "[EVENT_TEXT_FIELD]|contains": "system"
  selection_45:
    "[EVENT_TEXT_FIELD]|contains": "($_GET['"
  selection_46:
    "[EVENT_TEXT_FIELD]|contains": ">"
  selection_47:
    "[EVENT_TEXT_FIELD]|contains": "103.216.220.92"
  selection_48:
    "[EVENT_TEXT_FIELD]|contains": "31.223.184.166"
  selection_49:
    "[EVENT_TEXT_FIELD]|contains": "37.19.200.5"
  selection_50:
    "[EVENT_TEXT_FIELD]|contains": "134.209.159.64"
  selection_51:
    "[EVENT_TEXT_FIELD]|contains": "103.114.163.188"
  selection_52:
    "[EVENT_TEXT_FIELD]|contains": "95.217.98.37"
  selection_53:
    "[EVENT_TEXT_FIELD]|contains": "45.198.224.169"
  selection_54:
    "[EVENT_TEXT_FIELD]|contains": "92.118.112.100"
  selection_55:
    "[EVENT_TEXT_FIELD]|contains": "134.199.154.64"
  selection_56:
    "[EVENT_TEXT_FIELD]|contains": "117.55.202.115"
  selection_57:
    "[EVENT_TEXT_FIELD]|contains": "85.11.167.243"
  selection_58:
    "[EVENT_TEXT_FIELD]|contains": "221.14.159.134"
  selection_59:
    "[EVENT_TEXT_FIELD]|contains": "109.71.252.97"
  selection_60:
    "[EVENT_TEXT_FIELD]|contains": "91.90.123.25"
  selection_61:
    "[EVENT_TEXT_FIELD]|contains": "thunder.godofthunder.st"
  selection_62:
    "[EVENT_TEXT_FIELD]|contains": "hackattackkaboom.botlesscucks.st"
  selection_63:
    "[EVENT_TEXT_FIELD]|contains": "hik.gettingheadfromduckysmom.st"
  selection_64:
    "[EVENT_TEXT_FIELD]|contains": "b61a098fc62a2c2696e196dca78da71a"
  selection_65:
    "[EVENT_TEXT_FIELD]|contains": "c472dab4ff7c16782a8037f988d4daa6d4bdb343"
  selection_66:
    "[EVENT_TEXT_FIELD]|contains": "0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486"
  selection_67:
    "[EVENT_TEXT_FIELD]|contains": "267a3c8ed021a0a52c29bf076617a0dfd5cd5285202b8d0bd9ad0712110ccae8"
  selection_68:
    "[EVENT_TEXT_FIELD]|contains": "e2529d4afa39ae4db2eb05d5176317c906289abf09660c75bdeec43e54c55aa3"
  selection_69:
    "[EVENT_TEXT_FIELD]|contains": "150ae88f0999032e2a6113501d6082f54a3ed98d02427b21a96e773a27d7bf16"
  selection_70:
    "[EVENT_TEXT_FIELD]|contains": "40caf199ca1ebe056a74427f8e9db06c66899e33ae09c0ec2769ec70bf6dd8e7"
  selection_71:
    "[EVENT_TEXT_FIELD]|contains": "27d926a6708d6769d97d065e7a5a860ab496eab272c03d1cebc55ec71b954fa2"
  selection_72:
    "[EVENT_TEXT_FIELD]|contains": "1485e14e0f62bc94664eec341cabd275dad7d30b1d496c40ec340c9a0d9f0ba8"
  selection_73:
    "[EVENT_TEXT_FIELD]|contains": "xqsuvwz3n97wu8j3emz1axuo5y"
  selection_74:
    "[EVENT_TEXT_FIELD]|contains": "p2s9rdme2st6guc9g0rafic"
  selection_75:
    "[EVENT_TEXT_FIELD]|contains": "php2shell-scan"
  selection_76:
    "[EVENT_TEXT_FIELD]|contains": "php2shell-scan/109618"
  selection_77:
    "[EVENT_TEXT_FIELD]|contains": "php2shell-verify"
  selection_78:
    "[EVENT_TEXT_FIELD]|contains": "php2shell-poc"
  selection_79:
    "[EVENT_TEXT_FIELD]|contains": "B7kQpoc618"
  selection_80:
    "[EVENT_TEXT_FIELD]|contains": "B7kQpoc619"
  selection_81:
    "[EVENT_TEXT_FIELD]|contains": "BGCTXBOUNDARY"
  selection_82:
    "[EVENT_TEXT_FIELD]|contains": "./nfs php"
  condition: (((selection_1) and (selection_2) and (selection_3) and (selection_4) and (selection_5 or selection_6 or selection_7 or selection_8 or selection_9 or selection_10 or selection_11 or selection_12 or selection_13 or selection_14 or selection_15 or selection_16 or selection_17 or selection_18 or selection_19)) or ((selection_20) and (selection_21 or selection_22 or selection_23 or selection_24 or selection_25) and (selection_26 or selection_27 or selection_28 or selection_29 or selection_30 or selection_31 or selection_32 or selection_33 or selection_34 or selection_35 or selection_36 or selection_37)) or ((selection_38) and (selection_39) and (selection_40)) or ((selection_41) and (selection_42) and (selection_43) and (selection_44) and (selection_45) and (selection_46)) or (selection_47 or selection_48 or selection_49 or selection_50 or selection_51 or selection_52 or selection_53 or selection_54 or selection_55 or selection_56 or selection_57 or selection_58 or selection_59 or selection_60 or selection_61 or selection_62 or selection_63 or selection_64 or selection_65 or selection_66 or selection_67 or selection_68 or selection_69 or selection_70 or selection_71 or selection_72 or selection_73 or selection_74 or selection_75 or selection_76 or selection_77 or selection_78 or selection_79 or selection_80 or selection_81 or selection_82))
falsepositives:
  - "Broad investigation hunt with medium-high false positives. EVENT_TEXT must contain one complete event, including captured request headers/body where available; never concatenate unrelated records. Command words do not prove process execution or lineage. Substrings, case-insensitive matching and all five OR branches follow CISA. Kibana phrase matching is an approximation. The 267a3c8e… digest is retained as text because its byte scope is not established in the current referenced report. No hit establishes exploitation."
level: low
references:
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"hunt-cisa-keywords","group":"Optional hunts","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":true,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Broad investigation hunt with medium-high false positives. EVENT_TEXT must contain one complete event, including captured request headers/body where available; never concatenate unrelated records. Command words do not prove process execution or lineage. Substrings, case-insensitive matching and all five OR branches follow CISA. Kibana phrase matching is an approximation. The 267a3c8e… digest is retained as text because its byte scope is not established in the current referenced report. No hit establishes exploitation.","provenance":"Adapted from CISA 261429.r1.v1 (23 October). AND binds within each branch; the indicator branch is independent. The original critical severity is not carried into this optional low-severity hunt.","references":[{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - PHP2Shell scanner and PoC fingerprints"
id: c86b7086-119f-5167-812d-110832e9b1bb
name: php2shell_catalog_hunt_cisa_tool_fingerprints
status: experimental
author: "CISA (cisa.gov), Sierra Echo Charlie (adaptation)"
description: "Find reported scanner User-Agent fragments, multipart boundaries or the bgctxpoc session-cookie value."
date: 2026-10-25
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[USER_AGENT_FIELD]|contains": "php2shell-scan"
  selection_2:
    "[USER_AGENT_FIELD]|contains": "php2shell-verify"
  selection_3:
    "[USER_AGENT_FIELD]|contains": "php2shell-poc"
  selection_4:
    "[USER_AGENT_FIELD]|contains": "php2shell-109618"
  selection_5:
    "[USER_AGENT_FIELD]|contains": "php2shell-109619"
  selection_6:
    "[MULTIPART_BOUNDARY_FIELD]|cased":
      - "B7kQpoc618"
      - "B7kQpoc619"
      - "BGCTXBOUNDARY"
      - "BNDRY12345"
  selection_7:
    "[PHPSESSID_COOKIE_FIELD]|cased": "bgctxpoc"
  condition: (selection_1 or selection_2 or selection_3 or selection_4 or selection_5 or selection_6 or selection_7)
falsepositives:
  - "Independent fingerprint alternatives; no POST or upload-progress requirement. Parse the boundary parameter without quotes or MIME delimiter hyphens. Map PHPSESSID_COOKIE to the cookie value only. Missing fields may still match another alternative. Defaults are mutable and authorized testing can match."
level: low
references:
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
    - "https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"
    - "https://github.com/9bie/php2shell-bypass-aslr-exp/blob/4586f5cc120c82fd468b17469202bac629810ad9/exploit.py"
    - "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC/blob/main/poc_109618.py"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"hunt-cisa-tool-fingerprints","group":"Optional hunts","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":true,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Independent fingerprint alternatives; no POST or upload-progress requirement. Parse the boundary parameter without quotes or MIME delimiter hyphens. Map PHPSESSID_COOKIE to the cookie value only. Missing fields may still match another alternative. Defaults are mutable and authorized testing can match.","provenance":"CISA provides the broad scanner/boundary markers; ZEST adds the 109619 User-Agent and bgctxpoc cookie. Both referenced PoCs contain BNDRY12345. No exploit was executed.","references":[{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"},{"label":"9bie PoC — static source reference","url":"https://github.com/9bie/php2shell-bypass-aslr-exp/blob/4586f5cc120c82fd468b17469202bac629810ad9/exploit.py"},{"label":"eness PoC — static source reference","url":"https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC/blob/main/poc_109618.py"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - PHP-FPM child SIGBUS"
id: 95f485c2-6a31-5780-a114-986e676c6ba7
name: php2shell_catalog_fpm_bus
status: experimental
author: "CISA (cisa.gov), Sierra Echo Charlie (adaptation)"
description: "Find PHP-FPM children terminated by SIGBUS (signal 7)."
date: 2026-10-25
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[MESSAGE_FIELD]|re|i": "\\bchild[ \\t]+[0-9]+[ \\t]+exited[ \\t]+on[ \\t]+signal[ \\t]+7[ \\t]+\\(SIGBUS\\)"
  condition: selection_1
falsepositives:
  - "Worker crash diagnostic, not a CVE-specific verdict. Correlate bursts with request anomalies and worker identity."
level: low
references:
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
    - "https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"fpm-bus","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Worker crash diagnostic, not a CVE-specific verdict. Correlate bursts with request anomalies and worker identity.","provenance":"ZEST recommends reviewing FPM fatal signals 6, 7 and 11. Existing rules already cover SIGABRT and SIGSEGV.","references":[{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Windows PHP inline-code execution"
id: 386421bc-982d-57f0-8592-4622968d7de0
name: php2shell_catalog_hunt_php_inline_execution
status: experimental
author: "CISA (cisa.gov), Sierra Echo Charlie (adaptation)"
description: "Find php.exe processes invoked with the -r inline-code argument."
date: 2026-10-25
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[PROCESS_BASENAME_FIELD]": "php.exe"
  selection_2:
    "[PROCESS_ARGUMENT_FIELD]|cased": "-r"
  condition: (selection_1 and selection_2)
falsepositives:
  - "Expand the parsed argument array into one event per argument, retaining process identity; deduplicate matches. Match an actual -r argument, not text inside the inline code. Generic administrative use also matches; no web-worker parent is required."
level: low
references:
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
    - "https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"hunt-php-inline-execution","group":"Optional hunts","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":true,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Expand the parsed argument array into one event per argument, retaining process identity; deduplicate matches. Match an actual -r argument, not text inside the inline code. Generic administrative use also matches; no web-worker parent is required.","provenance":"ZEST recommends generic Windows php.exe -r detection. This is an optional hunt, not evidence of PHP2Shell by itself.","references":[{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - PHP web-root file changes and demo marker"
id: fc7620fc-1745-53de-9619-b1e57fa7264d
name: php2shell_catalog_hunt_webroot_file_change
status: experimental
author: "CISA (cisa.gov), Sierra Echo Charlie (adaptation)"
description: "Review PHP files created or modified in web roots, including the pwned.txt demonstration marker."
date: 2026-10-25
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[IS_WEB_ROOT_FIELD]": true
  selection_2:
    "[FILE_EVENT_ACTION_FIELD]|cased":
      - "[FILE_CREATE_ACTION]"
      - "[FILE_MODIFY_ACTION]"
  selection_3:
    "[FILE_EXTENSION_FIELD]": ".php"
  selection_4:
    "[FILENAME_FIELD]|cased": "pwned.txt"
  condition: (selection_1 and selection_2 and (selection_3 or selection_4))
falsepositives:
  - "Map IS_WEB_ROOT using the serving configuration and normalized file events. Select the incident time window; expected deployments and updates can match. The filename alone does not prove execution. The reported demo path is wp-content/uploads/pwned.txt."
level: low
references:
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
    - "https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"hunt-webroot-file-change","group":"Optional hunts","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":true,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Map IS_WEB_ROOT using the serving configuration and normalized file events. Select the incident time window; expected deployments and updates can match. The filename alone does not prove execution. The reported demo path is wp-content/uploads/pwned.txt.","provenance":"ZEST recommends reviewing recently created/changed PHP web-root files and the demo marker. Existing worker-unusual-web-file coverage requires a worker writer and a creation anomaly.","references":[{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Configured upload-progress field"
id: 07a18649-071e-5908-a724-aea2fff279fb
name: php2shell_catalog_configured_upload_progress
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find POST requests containing the effective server-configured upload-progress form name."
date: 2026-10-25
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[HAS_UPLOAD_PROGRESS_FIELD]": true
  condition: (selection_1 and selection_2)
falsepositives:
  - "Derive HAS_UPLOAD_PROGRESS by comparing decoded form names with the effective session.upload_progress.name for the target application. A literal default-name search cannot detect customized names. Legitimate uploads match; this is context, not an exploit verdict."
level: low
references:
    - "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
    - "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"configured-upload-progress","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Source supports the detection approach. Field mappings, thresholds and matching scope are local adaptations.","references":[{"label":"PHP advisory: CVE-2026-109618","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"},{"label":"Cloudflare PHP2Shell WAF protections","url":"https://blog.cloudflare.com/php-vulnerabilities-waf-protection/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Repeated identical array form parts"
id: cbf813c8-e2ec-56c1-8cfa-7eff707c17b0
name: php2shell_catalog_repeated_array_parts
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find multipart upload-progress requests repeating the same array-style form name unusually often."
date: 2026-10-25
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^multipart/form-data(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[HAS_UPLOAD_PROGRESS_FIELD]": true
  selection_4:
    "[MAX_IDENTICAL_ARRAY_FORM_PARTS_FIELD]|gte": "[REPEATED_ARRAY_PARTS_THRESHOLD]"
  condition: (selection_1 and selection_2 and selection_3 and selection_4)
falsepositives:
  - "Count repeated occurrences of each decoded array-style field name within one request, then take the maximum. The community heuristic uses 100; tune the threshold. This describes one exploit shape, not every CVE-2026-109618 vector."
level: low
references:
    - "https://github.com/darkfibr/php2shell-detect"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"repeated-array-parts","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Source supports the detection approach. Field mappings, thresholds and matching scope are local adaptations.","references":[{"label":"darkfibr community detector — exploit-shape heuristic","url":"https://github.com/darkfibr/php2shell-detect"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Serialized PHP tokens in upload filenames"
id: a395decb-8fde-592c-9ff1-9679e5a43bfa
name: php2shell_catalog_serialized_upload_filename
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find upload-progress multipart requests with serialized PHP object, class, array or string tokens in a filename."
date: 2026-10-25
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[CONTENT_TYPE_FIELD]|re|i": "^multipart/form-data(?:[ \\t]*;|[ \\t]*$)"
  selection_3:
    "[HAS_UPLOAD_PROGRESS_FIELD]": true
  selection_4:
    "[UPLOAD_FILENAME_FIELD]|re": "(?:O|C|a|s|E):[0-9]+:"
  condition: (selection_1 and selection_2 and selection_3 and selection_4)
falsepositives:
  - "Use one event per parsed filename, retaining request-level attributes. This local subset covers compound/string tokens; it omits standalone scalar tokens from the broader Splunk analytic. Never deserialize untrusted values. Kibana phrase approximation does not enforce token lengths and can miss punctuation-only evidence; prefer regex-capable formats."
level: low
references:
    - "https://research.splunk.com/web/47b3ff26-c4cc-4413-9bf3-f44dbac36785/"
    - "https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"serialized-upload-filename","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Source supports the detection approach. Field mappings, thresholds and matching scope are local adaptations.","references":[{"label":"Splunk serialized upload filename analytic","url":"https://research.splunk.com/web/47b3ff26-c4cc-4413-9bf3-f44dbac36785/"},{"label":"Datadog PHP2Shell analysis","url":"https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Large POST followed by HTTP 500"
id: eb6d49b3-9b8e-5067-81cc-a80b5b018dda
name: php2shell_catalog_large_post_500
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find large received POST bodies with a corresponding HTTP 500 response."
date: 2026-10-25
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[REQUEST_BODY_BYTES_FIELD]|gte": "[REQUEST_BODY_THRESHOLD_BYTES]"
  selection_3:
    "[RESPONSE_STATUS_FIELD]": 500
  condition: (selection_1 and selection_2 and selection_3)
falsepositives:
  - "Use actual received request-body bytes and the response for the same request, not Content-Length or response bytes. Splunk uses 1,000,000 bytes; tune locally. Generic application errors also match and successful execution need not return 500."
level: low
references:
    - "https://research.splunk.com/web/284ab19f-15f6-4f1c-9a4d-9f331438e37d/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"large-post-500","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Source supports the detection approach. Field mappings, thresholds and matching scope are local adaptations.","references":[{"label":"Splunk large POST and HTTP 500 analytic","url":"https://research.splunk.com/web/284ab19f-15f6-4f1c-9a4d-9f331438e37d/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Cloudflare PHP2Shell managed-rule matches"
id: 0404d600-15bb-584f-a09d-41f3f7e497eb
name: php2shell_catalog_cloudflare_php2shell
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find matches for the fourteen PHP2Shell managed-rule IDs documented by Cloudflare as of 25 October 2026."
date: 2026-10-25
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[WAF_RULE_ID_FIELD]|cased":
      - "4e315666e8e344cdb64119a3b5ccf32f"
      - "00c10e6cc4da4bd08722adeebcd95984"
      - "48ddf592361e4fdb97a8a85982dab691"
      - "3556683d512a47f2937899c524b1a4c6"
      - "da07c85852e34625bb478496302ede46"
      - "19373a83abb840e18ab3ce5a7975ce1b"
      - "07f0b6ddaabf40b1b2042dade8d613fa"
      - "c1d409ad838f47f59446f21cc438d5dd"
      - "f9a45927414245e3a64bb12d0a0c2f64"
      - "771c654ae1154d4daa72f4e1545d163c"
      - "217005865f0145f392300bac212afcc9"
      - "38efdb17ea594501bb55a1d71867b12e"
      - "4148ae686fdb4d01be673fab9d9c073d"
      - "1389aa259617437392ce149c48143645"
  condition: selection_1
falsepositives:
  - "Expand matched rules to one scalar rule ID per event and retain request ID, action, origin status, host and timestamp. Includes block/log matches without asserting execution. Coverage varies by plan, rule enablement and body inspection limits; IDs can change."
level: low
references:
    - "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"cloudflare-php2shell","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Source supports the detection approach. Field mappings, thresholds and matching scope are local adaptations.","references":[{"label":"Cloudflare PHP2Shell WAF protections","url":"https://blog.cloudflare.com/php-vulnerabilities-waf-protection/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Corelight potentially affected PHP version"
id: 39408262-1fcb-5c27-a58f-f10a2fae27f7
name: php2shell_catalog_corelight_affected_version
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find Corelight notices identifying potentially affected advertised PHP versions."
date: 2026-10-25
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[NOTICE_TYPE_FIELD]|cased": "PHP2SHELL::Potentially_Affected_PHP_Version"
  condition: selection_1
falsepositives:
  - "Requires the Corelight analyzer and visible HTTP response headers. A banner can be stale or hide vendor backports; this is inventory evidence, not exploitation or proof of vulnerability."
level: low
references:
    - "https://github.com/corelight/php2shell-detect"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"corelight-affected-version","group":"Exposure signals","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Source supports the detection approach. Field mappings, thresholds and matching scope are local adaptations.","references":[{"label":"Corelight Zeek / Suricata package","url":"https://github.com/corelight/php2shell-detect"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Web-worker descendant downloads from Previdian-reported infrastructure"
id: b5446229-bf38-56d5-8403-7695ca6b79de
name: php2shell_catalog_previdian_download_command
status: experimental
author: "Previdian Research; Sierra Echo Charlie (adaptation)"
description: "Find curl or wget command lines targeting the reported dotted or decimal IPv4 host on port 7 within a web-worker process tree."
date: 2026-10-29
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[WEB_WORKER_ANCESTOR_BASENAME_FIELD]|re|i": "^(?:apache2|httpd|nginx|frankenphp|php(?:[0-9]+(?:\\.[0-9]+)*)?|php-fpm(?:[0-9]+(?:\\.[0-9]+)*)?|php-cgi(?:[0-9]+(?:\\.[0-9]+)*)?|lsphp[0-9]*)$"
  selection_2:
    "[COMMAND_LINE_FIELD]|re": "\\b(?:curl|wget)[ \\t]+[^\\r\\n]*\\b(?:37455255|2\\.59\\.133\\.151):7(?:[/? \\t|;&)]|$)"
  condition: (selection_1 and selection_2)
falsepositives:
  - "The exact infrastructure fingerprint is mutable. Command-line matching establishes an attempted download, not network success or execution of retrieved content. Resolve ancestor identity from process telemetry, not a command-line substring."
level: low
references:
    - "https://blog.previdian.com/php2shell-activity-across-previdian-network/"
x_sec: {"catalog_id":"previdian-download-command","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. The exact infrastructure fingerprint is mutable. Command-line matching establishes an attempted download, not network success or execution of retrieved content. Resolve ancestor identity from process telemetry, not a command-line substring.","provenance":"Previdian Research, 28 October 2026, reports Apache shell execution on four honeypots. Local predicates and correlations are adaptations; command execution was observed but script retrieval and sleep execution were not.","references":[{"label":"Previdian Research — PHP2Shell Activity Across Previdian Network, 28 October 2026","url":"https://blog.previdian.com/php2shell-activity-across-previdian-network/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Web-worker downloader attempts an unusual outbound port"
id: e30c2b20-294e-50c0-8938-df8301f612c4
name: php2shell_catalog_hunt_web_worker_unusual_egress
status: experimental
author: "Previdian Research; Sierra Echo Charlie (adaptation)"
description: "Find curl/wget descendants of web workers attempting outbound connections on ports unusual for that service, including failed connections."
date: 2026-10-29
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[WEB_WORKER_ANCESTOR_BASENAME_FIELD]|re|i": "^(?:apache2|httpd|nginx|frankenphp|php(?:[0-9]+(?:\\.[0-9]+)*)?|php-fpm(?:[0-9]+(?:\\.[0-9]+)*)?|php-cgi(?:[0-9]+(?:\\.[0-9]+)*)?|lsphp[0-9]*)$"
  selection_2:
    "[PROCESS_BASENAME_FIELD]|cased":
      - "curl"
      - "wget"
  selection_3:
    "[NETWORK_DIRECTION_FIELD]|cased": "outbound"
  selection_4:
    "[DESTINATION_PORT_UNUSUAL_FIELD]": true
  condition: (selection_1 and selection_2 and selection_3 and selection_4)
falsepositives:
  - "Derive the unusual-port flag from a service baseline; port 7 is an example, not a universal threshold. Lowercase-normalize downloader basenames. Missing attempt telemetry can hide failures. Legitimate application downloads may match."
level: low
references:
    - "https://blog.previdian.com/php2shell-activity-across-previdian-network/"
x_sec: {"catalog_id":"hunt-web-worker-unusual-egress","group":"Optional hunts","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":true,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Derive the unusual-port flag from a service baseline; port 7 is an example, not a universal threshold. Lowercase-normalize downloader basenames. Missing attempt telemetry can hide failures. Legitimate application downloads may match.","provenance":"Previdian Research, 28 October 2026, reports Apache shell execution on four honeypots. Local predicates and correlations are adaptations; command execution was observed but script retrieval and sleep execution were not.","references":[{"label":"Previdian Research — PHP2Shell Activity Across Previdian Network, 28 October 2026","url":"https://blog.previdian.com/php2shell-activity-across-previdian-network/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - PHP session startup file or identifier failure"
id: b00f7262-ecdd-5ca2-8970-6099a7596aa8
name: php2shell_catalog_session_start_file_error
status: experimental
author: "Previdian Research; Sierra Echo Charlie (adaptation)"
description: "Find session_start file-open/read failures or rejected session identifiers for review alongside anomalous response cookies."
date: 2026-10-29
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[MESSAGE_FIELD]|re|i": "\\bsession_start\\(\\):[^\\r\\n]*(?:open\\([^\\r\\n]*\\)[^\\r\\n]*failed|Failed to read session data|Session ID[^\\r\\n]*(?:too long|illegal|invalid))"
  condition: selection_1
falsepositives:
  - "Permissions, disk faults and ordinary malformed clients also cause these errors. This is diagnostic context; length or an error alone does not establish memory disclosure."
level: low
references:
    - "https://blog.previdian.com/php2shell-activity-across-previdian-network/"
x_sec: {"catalog_id":"session-start-file-error","group":"Behavioral detections","cve_context":"CVE-2026-109618 / CVE-2026-109619 · investigation context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Permissions, disk faults and ordinary malformed clients also cause these errors. This is diagnostic context; length or an error alone does not establish memory disclosure.","provenance":"Previdian Research, 28 October 2026, reports Apache shell execution on four honeypots. Local predicates and correlations are adaptations; command execution was observed but script retrieval and sleep execution were not.","references":[{"label":"Previdian Research — PHP2Shell Activity Across Previdian Network, 28 October 2026","url":"https://blog.previdian.com/php2shell-activity-across-previdian-network/"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Upload-progress marker"
id: bb0f040d-329a-5b63-b51d-dccf22336d90
name: php2shell_catalog_upload
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Suricata SID 3000650."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[METHOD_FIELD]": "POST"
  selection_2:
    "[REQUEST_BODY_FIELD]|contains|cased": "PHP_SESSION_UPLOAD_PROGRESS"
  condition: (selection_1 and selection_2)
falsepositives:
  - "Also present in legitimate uploads. Decoding, truncation and inspection limits affect coverage."
level: low
references:
    - "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/"
    - "https://github.com/corelight/php2shell-detect"
    - "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
    - "https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"
    - "https://github.com/9bie/php2shell-bypass-aslr-exp/blob/4586f5cc120c82fd468b17469202bac629810ad9/exploit.py"
    - "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC/blob/main/poc_109618.py"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"upload","group":"Behavioral detections","cve_context":"Both CVEs · session handling context","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Also present in legitimate uploads. Decoding, truncation and inspection limits affect coverage.","provenance":"Marker supported by AWS; Corelight documents SID 3000650 for POST request-body inspection. Verify your installed ruleset and body limits. Additional references reviewed 25 October 2026 support the signal or mechanism; local thresholds, matching details and CVE attribution retain their stated limitations.","references":[{"label":"AWS MadPot report","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/"},{"label":"Corelight Zeek / Suricata package","url":"https://github.com/corelight/php2shell-detect"},{"label":"PHP advisory: CVE-2026-109619","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"},{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"},{"label":"9bie PoC — static source reference","url":"https://github.com/9bie/php2shell-bypass-aslr-exp/blob/4586f5cc120c82fd468b17469202bac629810ad9/exploit.py"},{"label":"eness PoC — static source reference","url":"https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC/blob/main/poc_109618.py"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Repeated multipart headers"
id: 6a0f9eae-5329-55a7-bfec-3bbaac93c762
name: php2shell_catalog_multipart
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Corelight PHP2SHELL::Multipart_Header_Flood."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[NOTICE_TYPE_FIELD]|cased":
      - "PHP2SHELL::Multipart_Header_Flood"
  condition: selection_1
falsepositives:
  - "Default threshold: 128; deployment settings may differ."
level: low
references:
    - "https://github.com/corelight/php2shell-detect"
    - "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"multipart","group":"Behavioral detections","cve_context":"CVE-2026-109618 · OOM opportunity","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Corelight default multipart_header_threshold=128 verified on 22 October 2026.","references":[{"label":"Corelight Zeek / Suricata package","url":"https://github.com/corelight/php2shell-detect"},{"label":"PHP advisory: CVE-2026-109618","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Unexpected PHPSESSID response"
id: 65242bc7-c825-5518-8a3b-a8d21d7d030e
name: php2shell_catalog_cookie
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find a PHPSESSID Set-Cookie value whose length exceeds a local upper threshold, differs from a route-specific baseline, or is malformed."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[COOKIE_NAME_FIELD]|cased": "PHPSESSID"
  selection_2:
    "[COOKIE_MALFORMED_FIELD]": true
  selection_3:
    "[COOKIE_LENGTH_ANOMALOUS_FIELD]": true
  selection_4:
    "[COOKIE_LENGTH_BYTES_FIELD]|gte": "[COOKIE_LENGTH_THRESHOLD_BYTES]"
  condition: (selection_1 and (selection_2 or selection_3 or selection_4))
falsepositives:
  - "[COOKIE_LENGTH_THRESHOLD_BYTES] is a local upper threshold; [COOKIE_LENGTH_ANOMALOUS_FIELD] is derived from a route-specific baseline and can include unusually short values. Do not infer memory disclosure from length alone. Document whether COOKIE_LENGTH_BYTES measures raw percent-encoded or decoded values and tune the threshold for that representation. This query does not join preceding multipart requests."
level: low
references:
    - "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
    - "https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/stealmybitcoin_poc.py"
    - "https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/README.md#what-each-request-does"
    - "https://www.wiz.io/blog/php2shell-php-rce"
    - "https://github.com/9bie/php2shell-bypass-aslr-exp/blob/4586f5cc120c82fd468b17469202bac629810ad9/exploit.py"
    - "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC/blob/main/poc_109618.py"
x_sec: {"catalog_id":"cookie","group":"Behavioral detections","cve_context":"Both CVEs · session-memory investigation","optional_hunt":false,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Unconfirmed interpretation. Links provide related context. The PoC checks 256-byte and 16-byte response PHPSESSID values in its leak stages. Length deviation and malformed-value detection are proposed heuristics; no universal PHPSESSID length is established. Additional references reviewed 25 October 2026 support the signal or mechanism; local thresholds, matching details and CVE attribution retain their stated limitations.","references":[{"label":"PHP advisory: CVE-2026-109619","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"},{"label":"Steal My Bitcoin PoC — request construction and sequence","url":"https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/stealmybitcoin_poc.py"},{"label":"Steal My Bitcoin PoC — request walkthrough","url":"https://github.com/KillaBoi/StealMyBitcoin-PoC/blob/main/README.md#what-each-request-does"},{"label":"Wiz PHP2Shell technical analysis","url":"https://www.wiz.io/blog/php2shell-php-rce"},{"label":"9bie PoC — static source reference","url":"https://github.com/9bie/php2shell-bypass-aslr-exp/blob/4586f5cc120c82fd468b17469202bac629810ad9/exploit.py"},{"label":"eness PoC — static source reference","url":"https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC/blob/main/poc_109618.py"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Apache child segmentation fault"
id: 8686c7a2-debf-51d4-8df4-5c55d09b11e0
name: php2shell_catalog_segfault
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Find Apache child segmentation faults (AH00051 or AH00052)."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[MESSAGE_FIELD]|re|i": "\\bAH0005[12]:[^\\r\\n]*\\bchild[ \\t]+pid[ \\t]+[0-9]+[^\\r\\n]*\\bexit[ \\t]+signal[ \\t]+Segmentation[ \\t]+fault[ \\t]+\\(11\\)"
  condition: selection_1
falsepositives:
  - "Exact CVE association and address-guess interpretation remain unconfirmed."
level: low
references:
    - "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
    - "https://github.com/SigmaHQ/sigma/pull/6506"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"segfault","group":"Behavioral detections","cve_context":"CVE-2026-109618 · supplied lab observation","optional_hunt":false,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Unconfirmed interpretation. Links provide related context. Exact log pattern and incorrect-address-guess interpretation supplied by the response brief; not independently reproduced here.","references":[{"label":"PHP advisory: CVE-2026-109618","url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"},{"label":"SigmaHQ proposal 6506 (review pending)","url":"https://github.com/SigmaHQ/sigma/pull/6506"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Web worker starts an unexpected command"
id: 3be7fae9-5036-50ec-b725-7f3cda6fe9a0
name: php2shell_catalog_process
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Web worker launching an unexpected child command."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[PARENT_BASENAME_FIELD]|re|i": "^(?:apache2|httpd|nginx|frankenphp|php(?:[0-9]+(?:\\.[0-9]+)*)?|php-fpm(?:[0-9]+(?:\\.[0-9]+)*)?|php-cgi(?:[0-9]+(?:\\.[0-9]+)*)?|lsphp[0-9]*)$"
  selection_2:
    "[PROCESS_BASENAME_FIELD]|re|i": "^(?:id|whoami|uname|hostname|ifconfig|netstat|sh|bash|dash|zsh|ksh|curl|wget|perl|nc|ncat|socat|python(?:[0-9]+(?:\\.[0-9]+)*)?)$"
  condition: (selection_1 and selection_2)
falsepositives:
  - "Includes versioned PHP/FPM/CGI/LiteSpeed basenames. Legitimate application subprocesses may match."
level: low
references:
    - "https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"
    - "https://www.nextron-systems.com/2026/10/22/php2shell-detection-coverage-in-thor/"
    - "https://graylog.org/post/detecting-php2shell-cves-with-graylog/"
    - "https://www.cisa.gov/"
    - "https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"
    - "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/"
    - "https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"process","group":"Behavioral detections","cve_context":"Both CVEs · execution corroboration, not CVE-specific","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support. Includes versioned PHP/FPM/CGI/LiteSpeed basenames. Legitimate application subprocesses may match.","provenance":"ELLIO lists PHP workers starting shells, interpreters or network tools. The candidate search includes shells, interpreters and network tools. Additional references reviewed 25 October 2026 support the signal or mechanism; local thresholds, matching details and CVE attribution retain their stated limitations.","references":[{"label":"ELLIO original report","url":"https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/"},{"label":"Nextron PHP2Shell coverage","url":"https://www.nextron-systems.com/2026/10/22/php2shell-detection-coverage-in-thor/"},{"label":"Graylog PHP2Shell detections","url":"https://graylog.org/post/detecting-php2shell-cves-with-graylog/"},{"label":"CISA","url":"https://www.cisa.gov/"},{"label":"CISA PHP2Shell Sigma rule — 261429.r1.v1","url":"https://raw.githubusercontent.com/cisagov/SIGMA_Rules/refs/heads/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml"},{"label":"AWS MadPot report","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Oversized URL-encoded form name"
id: 777ce0eb-a23d-526d-af64-d2f745c65776
name: php2shell_catalog_form_key
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Corelight PHP2SHELL::Large_Form_Key."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[NOTICE_TYPE_FIELD]|cased":
      - "PHP2SHELL::Large_Form_Key"
  condition: selection_1
falsepositives:
  - "Default: 65,536 bytes for the name, not the value or full body. Sensor body budgets still apply."
level: low
references:
    - "https://github.com/corelight/php2shell-detect"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"form-key","group":"Behavioral detections","cve_context":"Both CVEs · request-shape opportunity","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Corelight large_form_key_bytes=65536 default verified on 22 October 2026.","references":[{"label":"Corelight Zeek / Suricata package","url":"https://github.com/corelight/php2shell-detect"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Serialized-data anomalies"
id: d306d870-d86b-577a-9c42-4a0247d76ba2
name: php2shell_catalog_serialized
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Five parser-backed Corelight serialized-data notices."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[NOTICE_TYPE_FIELD]|cased":
      - "PHP2SHELL::Serialized_Integer_Overflow"
      - "PHP2SHELL::Serialized_Integer_Collisions"
      - "PHP2SHELL::Serialized_String_Collisions"
      - "PHP2SHELL::Serialized_Duplicate_Array"
      - "PHP2SHELL::Serialized_Object_Repetition"
  condition: selection_1
falsepositives:
  - "Notices describe request structure; application deserialization depends on route handling."
level: low
references:
    - "https://github.com/corelight/php2shell-detect"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"serialized","group":"Behavioral detections","cve_context":"Both CVEs · serialized-data opportunity","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Five Corelight PHP2SHELL notice names verified on 22 October 2026.","references":[{"label":"Corelight Zeek / Suricata package","url":"https://github.com/corelight/php2shell-detect"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Early or shutdown diagnostics"
id: 94450e81-83d4-5f43-a976-28491d9f4d98
name: php2shell_catalog_state
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Potential state retention across producer and consumer requests."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[MESSAGE_FIELD]|re|i": "\\b(?:PHP[ \\t]+(?:Warning|Fatal[ \\t]+error|Notice|Deprecated)|Maximum[ \\t]+execution[ \\t]+time|shutdown)\\b"
  condition: selection_1
falsepositives:
  - "Broad diagnostic text search; phase and worker reuse need event context."
level: low
references:
    - "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
    - "https://www.wiz.io/blog/php2shell-php-rce"
    - "https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"state","group":"Behavioral detections","cve_context":"CVE-2026-109619 · stale-state opportunity","optional_hunt":false,"verification":"Referenced","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"PHP advisory confirms producer/consumer operations across requests on the same worker. Text matching is an analyst-authored candidate search. Additional references reviewed 25 October 2026 support the signal or mechanism; local thresholds, matching details and CVE attribution retain their stated limitations.","references":[{"label":"PHP advisory: CVE-2026-109619","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"},{"label":"Wiz PHP2Shell technical analysis","url":"https://www.wiz.io/blog/php2shell-php-rce"},{"label":"ZEST PHP2Shell detection guidance","url":"https://www.zestsecurity.io/resources/content/php2shell-mitigate-php-now-patch-when-it-ships"}],"members":[],"aliases":[]}
---
title: "PHP2Shell - Unexpected session-file content"
id: 007e0b1b-b815-5aa3-9975-8afdbf0711f2
name: php2shell_catalog_session_files
status: experimental
author: "Sierra Echo Charlie; source attribution in references and x_sec"
description: "Session-directory content after suspicious multipart requests."
date: 2026-10-22
logsource:
  category: "[LOGSOURCE_CATEGORY]"
  product: "[LOGSOURCE_PRODUCT]"
detection:
  selection_1:
    "[DIRECTORY_FIELD]|cased": "[SESSION_SAVE_PATH]"
  selection_2:
    "[FILENAME_FIELD]|startswith|cased": "sess_"
  selection_3:
    "[CONTENT_REVIEW_SUSPICIOUS_FIELD]": true
  condition: (selection_1 and selection_2 and selection_3)
falsepositives:
  - "Serialized objects and user-controlled strings can be normal session data. [CONTENT_REVIEW_SUSPICIOUS_FIELD] is a local scanner/analyst flag."
level: low
references:
    - "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/"
    - "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
    - "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
    - "https://www.vulncheck.com/blog/php2shell-vulnerabilities"
tags:
    - cve.2026.109618
    - cve.2026.109619
x_sec: {"catalog_id":"session-files","group":"Behavioral detections","cve_context":"Both CVEs · host corroboration, not CVE-specific","optional_hunt":false,"verification":"Unconfirmed","notes":"Map logsource and fields in your Sigma pipeline. Replace numeric threshold placeholders with unquoted numbers. Case-sensitive, regex and numeric modifiers require backend support.","provenance":"Unconfirmed interpretation. Links provide related context. Session-file opportunity supplied by the response brief. AWS supports file-modification review; related PHP advisory covers session-state lifecycle. Additional references reviewed 25 October 2026 support the signal or mechanism; local thresholds, matching details and CVE attribution retain their stated limitations.","references":[{"label":"AWS MadPot report","url":"https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/"},{"label":"PHP advisory: CVE-2026-109619","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"},{"label":"Arctic Wolf PHP2Shell observations","url":"https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"},{"label":"VulnCheck original report","url":"https://www.vulncheck.com/blog/php2shell-vulnerabilities"}],"members":[],"aliases":[]}