Finding family: Exposure
Report
PHP2Shell, Hour by Hour: Who Showed Up in the First 59 Hours, and How
From the leak to a botnet carrying a live dropper in under three days. In the 59 hours after the leak, nine source IPs reached for PHP2Shell (CVE-2026-109618/109619): a noisy tool that sprays up to 1,300 requests per target, quiet clients that send one, a scanner that mapped its targets the day before the leak, and RedTail, a known cryptomining botnet, adding PHP2Shell-labelled attempts to its spreader 31 hours after the patch.