Attackers exploit PHP2Shell flaws to launch 35 shells on honeypots

SecurityWeek reports that attackers launched the shells from two IP addresses on October 24. Separately, Palo Alto Networks Unit 42 withdrew its earlier assessment linking an attack on a European government agency to PHP2Shell exploitation, according to The Hacker News. The company said the attack occurred in the context of a vulnerable PHP application.

Covered by 2 publishers within 20 hours of the first report.

• SecurityWeek: PHP2Shell Exploitation Moves From Probes to Working Shells

Reporting2

THN The Hacker News PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity · info@thehackernews.com (The Hacker News) 1:19 PM

SW SecurityWeek PHP2Shell Exploitation Moves From Probes to Working Shells · Eduard Kovacs 9:30 AM

Related

SW Attackers exploit Bricksforge plugin flaw to compromise WordPress sites October 12

THN PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware October 23

THN ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan October 19