After reviewing the "evidence" of exploitation of #PHP2Shell and finding it wanting, we have removed the "EITW" tag from our story.
Our standard for "exploited in the wild" is not sprays against targets. It is direct observables from successful exploitation. That's a higher bar to clear, but for such a scary vulnerability, hardly impossible. So far however, we have not seen that level of evidence.
IFIN - The Independent Federated Intelligence Network
npub1qm…nh363
2026-10-22 06:02:54 UTC
Author Public Key
npub1qm4tytdmranfklywc562p7gprs702mzkc4usqv6t8ja3d340evpslnh363Seen on
wss://relay.momostr.pinkPublished at
2026-10-22 06:02:54 UTCEvent JSON
{
"id": "c830401e1092aed86f15f40a3872153859815fd05bafa8925f16a578416bf998",
"pubkey": "06eab22dbb1f669b7c8ec534a0f9011c3cf56c56c57900334b3cbb16c6afcb03",
"created_at": 1792648974,
"kind": 1,
"tags": [
[
"t",
"php2shell"
],
[
"proxy",
"https://infosec.exchange/@ifin/117483043164948530",
"web"
],
[
"proxy",
"https://infosec.exchange/ap/users/115741367687413652/statuses/117483043164948530",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/ap/users/115741367687413652/statuses/117483043164948530",
"pink.momostr"
],
[
"-"
]
],
"content": "After reviewing the \"evidence\" of exploitation of #PHP2Shell and finding it wanting, we have removed the \"EITW\" tag from our story.\n\nOur standard for \"exploited in the wild\" is not sprays against targets. It is direct observables from successful exploitation. That's a higher bar to clear, but for such a scary vulnerability, hardly impossible. So far however, we have not seen that level of evidence.",
"sig": "60981fccd494f3832de619eaeb29f12bb9e5fc3b99caef7496c7671ac9bfc1bb479318631eda3131fa62174db194b3f120c4c7ad40ffe1984466d226da9c5895"
}