A surge of probes hit security sensors across the European Union on Oct 28, with the majority of the traffic originating from the IP address 23.165.56[.]186. The wave of activity attempted to leverage the PHP2Shell vulnerability, though the researcher who tracked the traffic reported that none of the attempts resulted in successful exploitations.
The increased scanning follows the first validated use of the exploit on Oct 26, when Perplexity researcher Adel Karimi observed attackers executing shell commands on honeypot servers to fetch payloads. While activity has increased, the cybersecurity firm Wiz reported that it has monitored similar PHP2Shell exploitation attempts and found that none have succeeded so far.
