OffSeq tracks PHP2Shell traffic ahead of the fix
OffSeq’s research examines PHP2Shell activity during the first 48 hours recorded by its Mirage honeypot fleet.
R/PHP (TOP), October 22, 2026
curated by Sönke
The company says PHP2Shell had leaked before a patch was available. Its first exploit-shaped request arrived roughly 16 hours before the fix was shipped. The supplied report excerpt contains no further technical details.
OffSeq’s research covers PHP2Shell activity during the first 48 hours observed by its Mirage honeypot fleet.
According to the report, PHP2Shell had leaked before its patch was available. The first request resembling an exploit reached the fleet about 16 hours before the fix shipped.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.