Honeypot sees scans for SAP NetWeaver webshells via CVE-2025-31324
SANS logged requests for ant.jsp and other upload paths, including an unauthenticated upload bug scored CVSS 10.
Stories per day · 30 days
Relatedphp10php2shell10rce5remote-code-execution5cryptomining4llmjacking3mcp3prompt-injection3xmrig3ai-agent2ai-agents2aws2cisa2deception2flowise2jailbreak2langflow2sonicwall2
57 stories, newest first · one card per story
Stories tagged #honeypot
Talos diverts hostile OT agent requests onto a plant twin
Across 2,400 autonomous attacker agents in four concealment tiers, no write reached the real plant.
Shibboleth traps fingerprint LLMs and harnesses in agentic attacks
Combined inference reached 90% top-1 accuracy across 15 models and 92% across four harnesses.
Scans for SSHole vulnerability (CVE-2026-123158) increase in honeypots
Honeypots report increase in SSH attacks for sshole starting November 1, with first exploits on November 5.
Coldframe honeypot mimics supermarket fridge controllers
Coldframe is an open-source IoT honeypot presented on Hacker News that impersonates supermarket refrigeration systems.
Honeypot logs Cisco IOS web UI scans suspected as CVE-2023-20198
SOAP posts to the web UI try to run uname -a and carry RootEvidence opt-out headers.
InferD honeypot answers AI-inference probes without executing models
Static response pools cover transport, protocol, vulnerability-surface and agentic-session deception planes.
Attackers probe newly patched critical Oracle EBS flaw
Defused honeypots logged exploratory exploits of CVE-2026-101767 on October 27; no other in-the-wild reports are cited.
1
1992 Cheswick paper on luring and studying the Berferd cracker
A Lobsters post links the classic PDF, but the feed snippet has no abstract or new findings.
Wiz reports limited PHP2Shell exploitation attempts after disclosure
Internet-exposed vulnerable machines fell about 67 percent, and captured attempts did not finish a general exploit chain.
PHP2Shell exploitation confirmed with working shells on honeypots
Karimi logged 35 shells on October 24 across three PHP 8.4.26 honeypots; CISA had not added the flaws to KEV.
SANS diary uses Kibana to hunt odd HTTP charsets in honeypot logs
A DShield honeypot logged about 960,000 events in three weeks, and Accept-Charset GBK stood out on SonicWall login probes.
Symantec finds AI agent built to hijack models for unattended attacks
The captured kit can run up to 100,000 steps, but researchers have no evidence it was used in real attacks.
Honeypot captures agent that hijacks exposed AI models
The captured prompt tells a stolen model to scan, exploit web apps, steal secrets and mine, for up to 100,000 steps.
PHP2Shell attacks started four days before public disclosure
Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; AWS saw broad exploitation and no full config-only workaround.
Attackers probed PHP2Shell flaws days before the October 21 patches
Amazon honeypots logged attempts against CVE-2026-109618 and CVE-2026-109619 from October 17; AWS later said exploitation was widespread.
PHP2Shell flaws drew millions of exploit attempts, some before disclosure
Amazon saw a honeypot hit on October 17, four days before patches, and Cloudflare has since logged millions of attempts.
Hacker attempts prompt injection on Flowise AI agent
Exposed Flowise honeypot shows attacker using AI agent for reconnaissance against other servers via prompt injection.
Hacker News · securitycriticalAmazon saw PHP2Shell exploitation on October 17, before disclosure
MadPot recorded attempts four days before CVE-2026-109618 and CVE-2026-109619 were disclosed, and Amazon says exploitation is now broad.
Symantec finds AI agent hijacking exposed models for autonomous attacks
A honeypot captured a five-layer jailbreak and a loop of up to 100,000 steps that scans, steals data, and installs XMRig.
5
Amazon says PHP2Shell was probed before disclosure and is now exploited
Fixes are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12; PHP 8.1 and earlier get no official patches.
Attacker probes Flowise honeypot for credentials and workflow hijacking
Sekoia’s emulated Flowise 2.2.8 captured credential queries and prompt injection, without proof of production theft.
2
PHP2Shell exploit attempt hit Amazon honeypot before disclosure
CVE-2026-109618 and CVE-2026-109619 allow pre-auth code execution on PHP 7.x and 8.x, both scored 9.2.
PHP RCE flaws probed four days before public patches
Amazon’s MadPot saw attempts from October 17; PHP2Shell was later called broadly exploited.