PHP2Shell weaponized after Japanese real estate extortion
Original title: PHP2Shell Weaponized After Japanese Real Estate Extortion
The captured page calls PHP2Shell PHP core remote code execution and promotes a version checker.
A SOCRadar headline says PHP2Shell was weaponized after a Japanese real estate extortion incident. The supplied page text is mostly site navigation and does not describe the attack, affected PHP versions, or a fix. A linked checker is described as identifying a site’s PHP version and exposure to PHP2Shell core RCEs.
Unconfirmed: Only the headline and site chrome were provided, so weaponization and the Japanese incident are not detailed.
- The page asks whether a PHP version is at risk of PHP2Shell RCE.
- Its checker is framed around PHP2Shell core remote code execution.
- No CVE, affected range, patch, or named victim appears in the text.
Impact: Remote code execution through PHP core flaws
| Product | Affected |
|---|---|
| PHP | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 96.126.130.81 | CRadar Threat Research Unit identified an open directory on 96.126.130.81 that exposed the working files of an operator who ran an ex |
From the original article
11 min read at socradar.io
An exposed server ties an extortion wave on about 20 Japanese property sites to an operator who later weaponized PHP2Shell (CVE-2026-109618, CVE-2026-109619)...
By Ameer Owda · socradar.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.