OffSeq’s research covers PHP2Shell activity during the first 48 hours observed by its Mirage honeypot fleet.

According to the report, PHP2Shell had leaked before its patch was available. The first request resembling an exploit reached the fleet about 16 hours before the fix shipped.