PHP2SHELL Activity 2026

Commands, URLs, hosts and file paths found in exploit payloads, including base64-wrapped layers, whether or not they succeeded; the sensors do not run PHP, so none of these executed. Long numeric per-target IDs are shown as <N>. Payload URL and URL in payload rows come from files GreyNoise retrieved from these servers (dates only); rows first retrieved before the earliest related activity are excluded. Payloads are truncated where the sensor index truncates long request bodies. Treat URLs and hosts as hostile; do not visit them.

malicious + any block-recommended tag (Memory Corruption Exploit, Request Memory Exhaustion, Session Poisoning) + spoofable:false

These clusters are automatically generated investigative leads, not attribution.