Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Notes

PHP leads read at their sources, 30 October 2026

kind
working record (unreviewed; candidates for the PHP account's next dated revision, not findings)
date
2026-10-30

PHP leads read at their sources, 30 October 2026

Row php-leads of schedule/due.csv, done by the scheduled run of 2026-10-30T1146Z (Claude Code, Anthropic cloud). The row asked for the report flagged on 29 October (BleepingComputer, 26 October: honeypot-confirmed code execution, data from Adel Karimi of Perplexity, confirmed by Marcus Hutchins of Expel) and two unread leads (TU Delft's PHP2shell observations; the "35 shells on a honeypot" report of 24 October) to be read at their primary sources, and what each claims logged, attributed. Following the sources those pages name led to a further, larger claim of compromise (Dream Research and Palo Alto Networks, section 4), read the same way.

Method. One direct GET per page, no retry, raw bytes up to 2 MiB, by collect.py; times, statuses, sizes and SHA-256 hashes are in read_log.json. Nine requests between 11:49:41 and 11:51:12 UTC on 30 October 2026, under the row's ceiling of ten. The bytes of the first-party pages are kept in pages/. The three BleepingComputer articles are news reports; this note quotes them and keeps their hashes, but not copies of them. No search, login or contact was made. Nothing was fetched through a model-backed reader.

Classes. Every claim below is reported by the named source, with what it rests on. None is a Lighthouse observation of an attack. A honeypot is a decoy, not a compromised organisation. Section 4 is a published report of compromise by others. Lighthouse records it attributed and makes no claim of its own that any named system is compromised (AGENTS.md, as clarified by the keeper on 24 October 2026).

1. BleepingComputer, 26 October: "PHP2Shell security flaws now sucessfully exploited in the wild"

Read 11:49:41 UTC, HTTP 200; byline Sergiu Gatlan, dated "October 26, 2026 05:19 AM". It reports that the two flaws "have been successfully exploited in the wild", caught by Adel Karimi's honeypots, which "recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26". It quotes Karimi's caveat that "it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications", and Hutchins: "This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far." It says CISA "has yet to flag the flaws as exploited in the wild", which was true of CISA's catalogue until its release of 26 October 22:24 UTC (LH031). It also reports that earlier activity was, in Dataminr's words, "limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises".

The sources it links are Karimi's report on GitHub (read, section 2), Karimi's posts on X and Hutchins's on X and LinkedIn (not read: these hosts need a login or refuse this container), and Dataminr's brief (not read).

2. Karimi's report: the primary source for the honeypot claim and for "35 shells"

https://raw.githubusercontent.com/0x4D31/honeypot-data/main/reports/php2shell/2026-10-24-confirmed-rce.md, read 11:50:04 UTC, HTTP 200, 27,787 bytes (kept). It is titled "PHP2Shell exploitation observed: packet-to-process RCE evidence" and dated "24 October 2026 · UTC · evidence acquired through 19:26–19:31 across six sensors".

  • What it claims. Packet captures and kernel process events "correlate 35 complete execution-stage HTTP POSTs with 35 /bin/sh starts directly parented by Apache workers (uid=33) across three PHP targets", on 24 October. The shells came from two source addresses (3 shells from one, 32 from the other). The report calls these "two source-address clusters, not an attribution to two actors".
  • What the targets were. "disposable phpot honeypots", running PHP 8.4.26 under single-worker Apache mod_php with a 128 MiB memory limit. The report says this is "the intentionally favorable single-worker mod_php profile". It ties the chain to CVE-2026-109618 and says "these records do not establish use of a distinct CVE-2026-109619 path".
  • What it rests on. The report cites a published evidence set of per-case captures and logs (not read) and a snapshot whose listed hashes matched. It says the traffic "closely matches the public HTTP-only PoC family".
  • The "35 shells" figure. This report is its primary source. It counts shell starts on decoys on one day, not compromised systems. The Italian page that repeated the figure (pasqualepillitteri.it, item 27254) was not read: at 11:49:42 UTC it answered with an Anubis challenge page, which bars automated readers until JavaScript proof of work is done, and its purpose is to keep out scrapers working for AI companies. We did not try to get past it.

3. TU Delft: "PHP2Shell in the Wild: live CVE-2026-109618 / CVE-2026-109619 exploitation data"

https://php2shell.delftintellab.com/, read 11:49:43 UTC, HTTP 200, 26,206 bytes (kept). The page is a live dashboard of the Delft Threat Intelligence Lab, Delft University of Technology, showing "Last updated: 2026-10-30 11:47:10 UTC" and refreshed every five minutes. What was kept is that one moment's snapshot. It reports, from its honeypots and network telescope since 20 October:

  • "76,216 exploitation requests from 680 source IPs in 317 autonomous systems and 73 countries, 2026-10-21 08:37:17 to 2026-10-30 11:40:30 UTC. 177 source IPs sent code or a dropper."
  • "2 IPs sent 49 requests before the fixed PHP releases ... on 2026-10-21." Its first request is at 08:37:17 UTC on 21 October, from the telescope. That is about five and a half hours before PHP's release at 14:00 UTC. Amazon's 17 October attempt does not appear in this lab's data.
  • By furthest step: "probe 55,835 [requests from] 566 [IPs]", "code execution 10,525 [from] 150", "overload 5,128 [from] 140", "dropper 4,728 [from] 51". Here "code execution" is a class of request content: requests that carried code. It does not mean a real system ran the code.
  • Four malware samples fetched by droppers, described by the lab: two Mirai-derived DDoS bots, a Nim backdoor and one unidentified program.

These are counts of traffic arriving at decoys and a telescope, so they bound activity aimed at sensors, not compromises. NCSC-NL's README links this page (LH032, 29 October checkpoint).

4. A published report of compromise: Dream Research, confirmed by Palo Alto Networks

BleepingComputer, 29 October, "CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks" (read 11:50:24 UTC, HTTP 200), led to two first-party sources:

  • Dream Research, "Chained PHP2Shell Exploit Roots 25 Servers, including US Government Servers", dated 26 October 2026 and updated 29 October (https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers, read 11:50:44 UTC, HTTP 200, kept). It reports that on 25 October its researchers "uncovered artifacts of what appeared to be a Chinese AI-assisted campaign that rooted 25 servers". The servers were Palo Alto Networks PAN-OS firewalls and management servers in the United States, Japan, Taiwan and South Korea, and three of them were "in a US government-affiliated environment". The attacker chained "a custom, non-public build" of the PHP exploit, aimed at the PHP 8.0.30 inside PAN-OS's management web server, with the Linux kernel flaw CVE-2026-46300 ("Fragnesia") to get root. The report gives a funnel: about 19,000 firewalls found, about 5,000 answering with a version, 240 targeted and 24 rooted, plus a 25th server reached through a tunnel. Of the 24, 22 were left "parked" with a webshell. It says the attacker went on to attack Active Directory, and that "we cannot determine the full extent of the compromise." On AI, it says Claude Code was installed on the attacker's infrastructure, along with an offensive tool configured with DeepSeek and Kimi. It also says "we have no direct evidence that the AI tools were specifically used to write the exploit", and that the code's style only "suggest[s] AI-assisted development". It names no actor. It says Unit 42 tracks the activity as CL-UNK-1280. What it rests on: artifacts Dream says it recovered from attacker infrastructure. These are not published, and Lighthouse has not seen them. Internal note: the headline's "25 servers" is the 24 rooted firewalls plus the management server.
  • Palo Alto Networks, Unit 42, "Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)" (https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/, read 11:50:54 UTC, HTTP 200, kept). Its 29 October update says "the PHP2Shell vulnerabilities are being actively exploited against PAN-OS management interfaces that are exposed to the internet", and "Unit 42 has independently verified the same attacker's tooling and confirmed the reported results". It also says "approximately .02%" of its installed base "has internet-facing management interfaces configured and were impacted", and that each affected customer was contacted.
  • Palo Alto Networks security advisory for CVE-2026-109618 (https://security.paloaltonetworks.com/CVE-2026-109618, read 11:51:11 UTC, HTTP 200, kept), published 21 October and updated 29 October. It sets "Exploit Maturity ATTACKED" and says: "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet." It lists PAN-OS 10.2 to 12.2 as affected below named hotfix builds, and says: "This issue will be fixed in the upcoming releases of PAN-OS". The upgrade table and the "will be fixed" sentence both appear on the page as read, so whether fixed builds were available at the read is unsettled. It records that Cortex XCORE and WildFire Cloud "[were] previously impacted" and patched on 21 and 22 October.

CISA's own entry, from a retained read. LH031's read of 29 October at 06:34 UTC (catalogue 2026.10.28, feed) already held CVE-2026-46300, added 28 October and due 31 October. Its description ends: "This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root." Its notes cite only kernel commits, BOD 26-04 and NVD. The LH031 checkpoints of 29 and 30 October and the log called that release's additions "unrelated"; they are corrected the same day (LH031 checkpoints, 30 October correction).

BleepingComputer's 27 October article, "CISA confirms PHP2Shell vulnerabilities now exploited in attacks" (read 11:50:23 UTC, HTTP 200), reports the 26 October catalogue listing and says CISA "has not yet shared further details". That agrees with LH031's reads.

What this changes, flagged for review

The released PHP account (articles/php-emergency-first-reading.md, version 1.2) and the week-one piece say that no source Lighthouse read shows an attack succeeded. The sources now read say three different things, and they must not be merged:

  1. Code ran on decoys: 35 shell starts on three honeypots on 24 October (Karimi, a first-party report with its method stated).
  2. A vendor reports successful compromise of real systems. Palo Alto Networks, in its own advisory and threat brief, reports active exploitation of its products' management interfaces and an impact on about 0.02 per cent of its installed base. Dream Research reports 25 rooted servers, three in a US government-affiliated environment. Both are others' published claims, attributed. Their evidence is not public, and Lighthouse has not checked it.
  3. CISA's catalogue states, in another flaw's entry, that the PHP flaws can be chained to implant webshells as root. That sentence describes capability, and the entry names no source for it.

These are candidates for the account's next dated revision, with the evidence and reader reviews, as row php-later-evidence-10-30 in schedule/due.csv. Until then, nothing here reaches a public page. The account's sentence "it does not show that any attempt succeeded" is about CISA's listing, and it stays true of that listing. A reader of the whole account would now be misled by it, though, so the revision should come soon.

Not read

Karimi's evidence set (2026-10-24-rce-evidence/) and his earlier attempts report; Karimi's and Hutchins's posts on X and LinkedIn; Dataminr's brief; CISA's alerts of 26 and 28 October (cisa.gov refuses this container); the Italian page (behind Anubis, which bars automated readers); Dream's linked earlier posts. Any of them could change what is attributed here.

From notes/php-leads-2026-10-30/leads.md in the repository, last changed 30 October 2026.