PHP2Shell
Scan, Stage, Command: Tracing a Potassium Cluster From PHP2Shell-Labelled Attempts to Its C2 Infrastructure
An address on a shared hosting range tried a PHP2Shell-labelled chain, then React2Shell, against the same target two hours apart. Both pointed to one staging server and one Potassium bot. Decode the bot's DNS answers and one of its configured C2 addresses sits in the same /24 as the scanners. A field note on correlating scanning, staging and command infrastructure, and on why a request labelled "PHP2Shell" is not proof that PHP2Shell was exploited.
11 min readPHP2Shell, Hour by Hour: Who Showed Up in the First 59 Hours, and How
From the leak to a botnet carrying a live dropper in under three days. In the 59 hours after the leak, nine source IPs reached for PHP2Shell (CVE-2026-109618/109619): a noisy tool that sprays up to 1,300 requests per target, quiet clients that send one, a scanner that mapped its targets the day before the leak, and RedTail, a known cryptomining botnet, adding PHP2Shell-labelled attempts to its spreader 31 hours after the patch.
11 min read