Research focus: PHP2Shell exploitation attempts, K4nha botnet-kit C2, Sliver C2, custom Python tooling, cryptojacking-associated artifacts, and hosting infrastructure.
PHP2Shell has brought renewed attention to the security of internet-facing PHP environments. However, the initial vulnerability is only one part of the investigation. The infrastructure, tooling, and activity surrounding exploitation attempts can provide additional evidence for defenders.
Threatactix is tracking 15 PHP2Shell-related campaigns, with telemetry spanning multiple activity patterns, including:
This report presents eight selected activity profiles from our current investigation, along with the relevant artifact categories and defensive hunting priorities.
PHP2Shell refers to two critical PHP vulnerabilities:
CVE | Vulnerability description |
CVE-2026-109618 | Memory corruption associated with out-of-memory handling during request processing |
CVE-2026-109619 | Use-after-free involving stale internal request state |
Under affected conditions, these vulnerabilities can enable unauthenticated remote code execution. The flaws exist in the PHP runtime rather than necessarily in an individual application’s business logic.
The PHP project published fixes on October 21, 2026, including PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations should verify the applicable vendor package and subsequent security updates.
Sources: PHP security advisory
Activity: PHP2Shell exploitation attempts | K4nha-associated tooling | Infrastructure discovery
Our telemetry describes an activity profile associated with a Russian operator and involving K4nha botnet-kit C2, with exploitation attempts across the European region.
The supplied artifact inventory includes K4nha kit archives, geographic datasets, probing utilities, fleet-discovery scripts, and associated output files.
Relevant artifact names
The supplied output inventory includes country-associated labels for Germany (DE), France (FR), the United Kingdom (GB), the Netherlands (NL), Ukraine (UA), and the United States (US). An additional file, cronpwn_eu.txt, refers to a European-region dataset.
Campaign profile: K4nha Botnet-Kit C2
Hunting priorities
Activity: Account automation | Financial fraud tooling | Web-shell-associated components
The supplied inventory contains reward-task automation, account-creation scripts, proxy-pool files, CAPTCHA-solving utilities, and platform-specific automation components.
The associated activity description identifies cryptocurrency faucet and micro-reward platforms as the target context.
Relevant artifact categories
Campaign profile: Financial fraud tooling
Hunting priorities
Activity: PHP2Shell exploitation attempts | Sliver C2 | SMTP authentication and STARTTLS testing
The campaign description associates this activity with a Serbian actor. The supplied inventory contains PHP2Shell-related scanning and validation utilities, out-of-band callback components, Sliver client artifacts, and SMTP testing tools.
Together, these provide several investigative paths to correlate web activity with subsequent host and network behavior.
Campaign profile: Open Profile 03 — Sliver C2 and SMTP Activity
Hunting priorities
Activity: Exploitation attempts | Sliver C2 | SMTP and STARTTLS testing
A separate telemetry entry exhibits a pattern similar to Profile 03 but uses a different IP address.
The shared activity categories justify comparative analysis, but the two observations should remain distinct until the evidence supports clustering.
Campaign profile: Open Profile 04 — Separate-IP Sliver Activity
Hunting priorities
Activity: Exploitation tooling | Java archives | Cryptojacking-associated software
The supplied inventory includes PHP2Shell-related workbench directories, Java archive files, application-testing artifacts, and a directory named xmrig-6.26.0, associated by name with XMRig cryptomining software.
These artifacts warrant investigation into potentially unauthorized execution, resource abuse, and application compromise.
Relevant artifact categories:
Campaign profile: Open Profile 05 — Exploitation and Cryptojacking Investigation
Hunting priorities
Activity: Security-testing tools | Post-exploitation-associated artifacts | Gaming infrastructure
The supplied inventory contains security-testing and post-exploitation-associated artifacts, including:
Campaign profile: Open Profile 6 – Adversary Emulation toolkit
Hunting priorities
Activity: PHP2Shell-related exploitation attempts | Hosting infrastructure | Potential unauthorized access
The supplied inventory describes a hosting-related environment associated with high-performance gaming servers, VPS/VDS services, and anti-DDoS infrastructure.
The inventory includes directories labelled CVE-2026-109618, c2, and php2shell, alongside application and server-management artifacts.
These observations provide leads for investigating potentially exposed services, suspicious administrative activity, and unauthorized changes.
Campaign profile: Open Profile 07 — Hosting and VPS Infrastructure
Hunting priorities
Activity: Custom Python tooling | Exploitation-related activity | C2 investigation
The supplied inventory explicitly describes a custom Python-orchestrated PHP2Shell C2 engine associated with CVE-2026-109618 and CVE-2026-109619.
Relevant filenames include:
The inventory also contains Nuclei-template-related artifacts and versioned supporting materials.
Campaign profile: Open Profile 08 — Python-Orchestrated C2
Hunting priorities
The profiles point to several practical areas for investigation.
Telemetry source | What to investigate |
Web server and WAF logs | Suspicious requests, malformed multipart requests, repeated HTTP errors |
PHP runtime and EDR | Unexpected child processes, PHP worker churn, unusual execution |
File integrity monitoring | Unexpected PHP files, scripts, and application changes |
DNS, firewall and proxy logs | Recurring destinations and unusual outbound connections |
Mail-server logs | Unexpected SMTP authentication and STARTTLS activity |
Host-performance telemetry | Unexplained CPU consumption and possible cryptomining |
Persistence and configuration records | Unexpected services, scheduled tasks, and configuration changes |
For PHP2Shell specifically, Wiz Research describes investigation signals including unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unexpected PHP worker churn, and anomalous session-cookie behavior. These are investigative leads rather than definitive indicators of compromise.
Reference: Wiz Research — PHP2Shell technical analysis.
Patching is the priority. Where exploitation is suspected, patching should be accompanied by an investigation for evidence of prior compromise.
The eight profiles illustrate why a vulnerability alert is only the starting point for an investigation.
The activity descriptions span botnet-associated C2, Sliver-related infrastructure, automated financial fraud tooling, Java-related artifacts, cryptomining-associated software, gaming-server environments, hosting infrastructure, and a custom Python C2 workbench.
The practical challenge is connecting those observations to evidence: whether an exploit request succeeded, whether execution followed, which infrastructure was contacted, and whether the affected system requires incident response.
Threatactix is tracking 15 PHP2Shell-related campaigns and developing investigative context to support security teams in prioritizing suspicious infrastructure and turning observations into actionable threat-hunting workflows.
Explore the Threatactix Intelligence Portal for campaign-specific threat intelligence, attacker infrastructure insights, and actionable threat-hunting opportunities.
Explore the Intelligence Portal: https://intelligence.threatactix.com/
Request a PHP2Shell Intelligence Briefing: Contact Threatactix and mention PHP2SHELL to discuss campaign intelligence, relevant indicators, and available threat-hunting playbooks.
Uncover the infrastructure. Understand the campaign. Hunt what others miss.