SOCRadar researchers discovered PHP2Shell exploit tooling on an exposed attacker-controlled server, including a lab-tested remote code execution chain targeting PHP 8.4.26 running as Apache mod_php and scripts scanning about 20 public websites for vulnerable configurations. Though none of the tested sites met the exploit’s preconditions or showed evidence of compromise, the findings highlight that only patching PHP removes the risk, as hardened settings alone can block this attack chain. Additional tools on the server suggest a financially motivated operator conducting wider reconnaissance and intrusion activities beyond PHP exploitation.
https://socradar.io/blog/php2shell-exploit-tooling-attacker-server/