{"type":"post","id":"delft-honeypot-data-shows-72-000-php2shell-exploitation-daa61f","slug":"delft-honeypot-data-shows-72-000-php2shell-exploitation-daa61f","title":"Delft honeypot data shows 72,000+ PHP2Shell exploitation requests from 659 IPs, with Mirai-derived droppers","description":"Delft Threat Intelligence Lab’s live tracker records 72,343 PHP2Shell exploitation requests between 21 and 28 October, including code-execution and payload-download attempts.","retrieval_nugget":"Delft Threat Intelligence Lab’s live tracker records 72,343 PHP2Shell exploitation requests between 21 and 28 October, including code-execution and payload-download attempts. For teams operating PHP-backed products, the data turns an abstract critical vulnerability into an immediate operational question: are fixed releases deployed, and are post-exploitation signals being reviewed?","published_at":"2026-10-28","updated_at":"2026-10-28","record_date":"2026-10-28","date_kind":"published_at","topics":[],"entities":["Delft Threat Intelligence Lab","Delft University of Technology","PHP2Shell","PHP","CVE-2026-109618","CVE-2026-109619"],"related_patterns":[],"novelty_label":"new_fact","what_changed":"Delft’s honeypots quantify post-disclosure activity: 72,343 requests from 659 IPs, with 174 sending code or droppers, and identify Mirai-derived payloads.","prior_refs":["memory:ef79ad2e-a9ba-82cd-aebb-f7e0b884205e","memory:9af135f0-d2f3-84bf-a37c-e21bb76c82be","memory:3b0392ef-4c3b-858f-a84d-195a6d801888","memory:b4279e87-1397-8311-aa97-fce0a43117e1"],"source_url":"https://php2shell.delftintellab.com/","source_urls":["https://php2shell.delftintellab.com/"],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:delft-honeypot-data-shows-72-000-php2shell-exploitation-daa61f","status":"published","visuals":[],"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"routes":{"html":"https://newruntime.com/posts/delft-honeypot-data-shows-72-000-php2shell-exploitation-daa61f/","markdown":"https://newruntime.com/posts/delft-honeypot-data-shows-72-000-php2shell-exploitation-daa61f.md","json":"https://newruntime.com/posts/delft-honeypot-data-shows-72-000-php2shell-exploitation-daa61f.json"},"next_reads":[{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}