Adel Ka 0x4D31

PHP2Shell: observed exploitation attempts, 22–24 October 2026

Across six instrumented PHP-backed web personas, a 26-hour, 43-minute capture recorded 30 pre-script out-of-memory errors and 11 worker crashes. The traffic included repeated leak-stage payloads, distributed fixed-length probes, serializer-oriented requests, and large chunked uploads. No remote code execution or usable memory disclosure was confirmed.

The observation window runs from 22 October 22:45 to 24 October 01:28 UTC. All times below are UTC; application names such as WordPress and Drupal refer to the presented web personas, not findings against those CMS products.

Jump to: Campaign overview · Source outcomes · Crash timeline · IP and reverse-DNS appendix · Request aggregates · Fingerprints · Request excerpts

Libssh authentication bypass vulnerability (CVE-2018-10933)

An analysis of Censys Public Scan 20180807 (only port 22) to estimate the number of servers {potentially} vulnerable to the recent Libssh bug.

CryptoAUS Honeytoken Workshop

Honeytoken {Creation | Distribution | Monitoring}

How-To

Use honeyλ to create and monitor URL honeytokens automatically
Use honeybits to generate honeyfiles and breadcrumbs
Set up CanaryTokens

Transforming Code into Beautiful, Idiomatic Python

Notes from Raymond Hettinger's talk at pycon US 2013 video, slides.

The code examples and direct quotes are all from Raymond's talk. I've reproduced them here for my own edification and the hopes that others will find them as handy as I have!

Looping over a range of numbers

for i in [0, 1, 2, 3, 4, 5]:

	device,test_context,role,mode,frame,band,observations,iefp_sha256,iefp_canonical,note
	"Hak5 WiFi Pineapple Mark VII","firmware 2.1.3","AP","Open / Management / Evil WPA","Beacon","2.4 GHz",5156,"71f6e24349c80fddaf9030140eff4d43739e16a9676d7cb37ae02590ecc93119","iefp/1\|frame=beacon\|element_order=45,127\|rates=\|capabilities=45:ec0103ffff000000000000000000000100000000000000000000,127:0400000200000040\|vendors=","Same profile across three AP modes; SSID and security are outside IEFP."
	"Hak5 WiFi Pineapple Mark VII","firmware 2.1.3","AP","Open / Management / Evil WPA","Probe Response","2.4 GHz",143,"1f768059ed5d5981640c41c21206f0be02270c240c199eb8b8a65bd35305bdf2","iefp/1\|frame=probe_response\|element_order=45,127\|rates=\|capabilities=45:ec0103ffff000000000000000000000100000000000000000000,127:0400000200000040\|vendors=","Same profile across three AP modes; SSID and security are outside IEFP."
	"Hak5 WiFi Pineapple Mark VII","firmware 2.1.3","AP","PineAP Broadcast SSID Pool","Beacon","2.4 GHz",837,"94e08bdd9c5105150e677

	<!doctype html>
	<html lang="en">
	<head>
	<meta charset="utf-8" />
	<title>Finch SSE Events</title>
	<meta name="viewport" content="width=device-width, initial-scale=1" />
	<style>
	:root {
	--bg: #fff;
	--card-bg: #f8f9fa;

	"os version","rdp client","ja3","ja3Algorithms","note"
	"Windows XP SP3","RDC 6.1.7600","c8a0d08d2cbee4bed7cd90e47588ab9b","769,4-5-10-9-100-98-3-6-19-18-99,65281,,",
	"Windows 2012","RDC 6.2.9200","bc2874f25a8254edb36147c151527cfa","771,49192-49191-49172-49171-159-158-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19-5-4,0-5-10-11-13-35-23-65281,23-24,0",
	"Windows 2008r2","RDC 6.3.9600","e6a4e2358d4eee6122403f3cb835bcbd","771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19-5-4,0-5-10-11-13-23-65281,23-24,0",
	"Windows 2012r2","RDC 6.3.9600","3e686105164b7c9a4cbd59142f18a4e7","771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19-5-4,0-5-10-11-13-35-23-65281,23-24,0",
	"Windows 7","RDC 6.3.9600","d54b3eb800cbeccf99fd5d5cdcd7b5b5","771,49192-49191-49172-49171-159-158-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19-5-4,0-5-10-11-13-23-652