# Live news

Canonical: https://ournews.ai/live/1a0d727e-d67e-41d3-930b-01f255036727
Published: 2026-10-26T19:39:50.160518+00:00
Updated: 2026-10-26T19:39:50.160518+00:00

Perplexity’s Adel Karimi reports 35 successful shell executions across three PHP2Shell honeypots on October 24, supported by packet and process evidence. The targets used PHP 8.4.26 under single-worker Apache mod_php—an intentionally favourable setup for exploitation. This is evidence of code execution, not merely a crash, but it does not establish the same reliability on other builds or configurations. It also does not mean 35 unrelated production websites were breached. The “maybe it only crashes” argument has acquired a rather inconvenient process log.

Source: Adel Karimi — https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md
Source date: 2026-10-24