Re:Amazon identifies Oct 17 PHP2Shell exploitation prior to ...
by decidu0us9034 on Thursday October 22, 2026 @01:45PM
(#50198697)
"Exploitation attempt" lacks clarity. The bot scanners are constantly generating huge volumes of weird traffic. Does anyone have a portable, reliable exploit that works in real heterogeneous conditions and not a lab setup, and is that even feasible? doesn't seem like it. llms automate development of practical exploits but don't remove every constraint that makes them hard to begin with. it feels like people are missing this, idk
[ Parent
| on HN ]
Re:Amazon identifies Oct 17 PHP2Shell exploitation prior to ...
by berkes on Wednesday October 28, 2026 @10:09AM
(#50273856)
On the only machine where I can still see this, I see a significant increase in bot-scanners - the stupid brute forcers just attempting /wp-admin and such. These are "fail2banned" - an ever growing list of urls and endpoints from software that I know I don't run: anything php, java, etc -, and what I see a (totally not structurally collected, unfortunately) significant increase in these bans.
I've seen this increasing since before the patches were released and PoCs became available and more usable.
My theory is that botnets are cranking up their scanning to have an up-to-date and large list of potential targets once they can reliably use the exploit to take over those targets.