PHP2Shell exploitation surges while most public PHP stays unpatched
Cloudflare's CEO said attempts reached millions within hours of disclosure; Ox still saw 97.5% unpatched on October 23.
86
- Mentions · 7d4
- Mentions · 30d4
- All mentions5
- First seenSep 25, 2026
- Last mentioned2d ago
Timeline
5 articles · newest firstScattered Spider uses help-desk calls to bypass MFA
Flare says a help-desk call alone does not prove the group, and CISA urges phishing-resistant MFA.
52
Flare says Scattered Spider, LAPSUS$ and ShinyHunters are separate clusters
Shared branding does not prove one gang; Flare treats original LAPSUS$ as defunct after September 2022.
48
Underground sellers package fake IDs and deepfakes for KYC
The OnlyFake operator pleaded guilty over a service that generated more than 10,000 fraudulent identity documents.
52
TWEAKOS Malware Turns Telegram Into a Stealer, C2 Platform and Stolen Account Marketplace
TWEAKOS steals Discord tokens and Telegram sessions, then sells that access through a Telegram bot.
48
Appears with
- Scattered Spiderthreat actor · 2
- CISAorganization · 2
- Octo Tempestthreat actor · 2
- PHP Foundationorganization · 1
- SP1D3R HUNTERSthreat actor · 1
- ShinyHuntersthreat actor · 1
- DragonForcemalware · 1
- FinCENorganization · 1
- Check Point Researchorganization · 1
- U.S. Department of Justiceorganization · 1
- Telegramproduct · 1
- UNC6240threat actor · 1
- UNC6040threat actor · 1
- Windowsproduct · 1
- Microsoftorganization · 1
- Cloudflareorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.