HIGHApt
Global

Honeypots Now Recording in-the-Wild PHP2Shell Exploits

·Source: Bank Info Security

Updated:

Executive Summary

Exploit for PHP2Shell Shreds 'Steal My Bitcoin' Challenge Never underestimate the power of a cash prize to separate cybersecurity hype from reality, as a researcher has bagged $2,000 in bitcoin in a capture the flag con

Analysis

Exploit for PHP2Shell Shreds 'Steal My Bitcoin' Challenge Never underestimate the power of a cash prize to separate cybersecurity hype from reality, as a researcher has bagged $2,000 in bitcoin in a capture the flag contest to demonstrate an exploit for PHP2Shell in the wild. The winning CTF move followed reports of honeypots clocking in-the-wild attacks.

Indicators of Compromise (2)

URL (1)
https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/honeypots-now-recording-in-the-wild-php2shell-exploits-image_small-1-a-33206.jpg
VirusTotalURLhaus
Domain (1)
ismg-cdn.nyc3.cdn.digitaloceanspaces.com
VirusTotalURLhaus
Source Attribution

Originally published by Bank Info Security on Oct 26, 2026.

Related Threats

MEDIUMApt

Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up

The Hacker News
MEDIUMApt

Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across

The Hacker News
MEDIUMApt

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. [...]

BleepingComputer