PHP2Shell: 92.6% of the attackers were already known to OneFirewall.
On 21 October 2026 a three-hour burst of automated requests hit .php endpoints at Alliance members. 25 of the 27 source IPs were already in the OneFirewall database, and they sent 99.96% of the attempts.
One request to a vulnerable PHP file is enough.
Attackers scan the internet for PHP files they can abuse: a vulnerable upload form, an eval endpoint, or a web shell left behind by an earlier break-in. One successful hit gives them remote code execution on the web server, and everything that follows.
- 01ScanAutomated requests probe .php paths across the internet.
OneFirewall blocks here - 02ExploitAn upload form, eval endpoint or old web shell accepts the payload.
- 03ExecuteThe attacker runs code on the web server.
- 04SpreadData and credentials are stolen, and the attacker moves into the internal network.
- 05Cash inRansomware is deployed or the server joins a botnet.
A blocking rule acts at step 1: a known IP never reaches the PHP endpoint, so the later steps never start.
From under 100 requests an hour to 15,562.
The evening was quiet until 20:00 UTC. Then came 6,284 attempts in the first hour, 15,562 in the second and 10,406 in the third, and the wave stopped as sharply as it had started.
Attempts per hour, 21 October 2026, UTC. Orange marks the burst.
Most of the attackers were already scored, and most were scored high.
OneFirewall gives every IP a crime score from 0 to 1000, built from what Alliance members report. At the time of each event, 25 of the 27 IPs had a score of at least 10, and 17 were already Critical (150 or more), sending 89.6% of the traffic.
| Blocking threshold (score at least) | IPs blocked | Share of IPs | Share of attempts | IPs that get through |
|---|---|---|---|---|
| 10 | 25 of 27 | 92.6% | 100.0% | 2 |
| 30 | 23 of 27 | 85.2% | 99.9% | 4 |
| 80 | 20 of 27 | 74.1% | 90.9% | 7 |
| 150 (Critical) | 17 of 27 | 63.0% | 89.6% | 10 |
Score at the time of each event. 100.0% is rounded: 99.96% of attempts came from known IPs.
Some attackers were known for over a year, others for less than a day.
Of the 25 known IPs, 12 had been scored more than a month before the attack. 5 were picked up only in the 7 days before it, and 2 in the last 24 hours: intelligence from one member reaches every other member fast enough to matter.
When each of the 25 known IPs was first scored by OneFirewall. Orange marks the last 7 days.
Critical-scored IPs sent nine attempts in ten.
17 of the 25 scored IPs were Critical, and they sent 28,899 attempts. Medium-scored IPs sent 3,190, High 145 and Low 4.
| IP | Country | Attempts | Score |
|---|---|---|---|
| 216.36.112.x | US | 5,330 | 436 |
| 171.34.139.x | CN | 4,940 | 677 |
| 80.94.95.x | RO | 4,685 | 444 |
| IP | Country | Attempts | Score |
|---|---|---|---|
| 171.34.139.x | CN | 4,940 | 677 |
| 103.160.205.x | ID | 2,647 | 584 |
| 169.58.137.x | US | 4,390 | 558 |
Critical 150 or more, High 90 to 150, Medium 40 to 90, Low under 40. The last octet of each IP is masked.
Known attackers are stopped at the first request.
This is how OneFirewall contains exploitation attacks like PHP2Shell: before a patch is applied, and before anyone in the SOC has read an alert.
Known before the first request
25 of the 27 IPs were in the OneFirewall database before the burst started. A blocking rule on the firewall would have dropped them at the first request, before any PHP file was touched.
Shared across the Alliance fast
An IP reported by one member is scored and sent to every member. 5 of these attackers were scored only in the 7 days before the attack, and 2 in the last 24 hours.
Safe to deny automatically
IPs scored High or Critical sent 90% of the burst. At that confidence the rule can be enforced without a person approving each block.
Enforced on the firewall you already run
The WCF Agent pushes the scored list to any of 166+ integrations, including Check Point, Fortinet and Palo Alto, so the block happens at the perimeter, not in the application.
See the integrations →Recommendation: set your blocking score threshold below 150. At 150, 10 of these 27 IPs would have got through. At 80, 20 of the 27 IPs and 91% of the traffic are blocked. Also patch or remove any exposed PHP upload and eval endpoints.
How these numbers were produced
- Source: live events from Alliance members who have opted in to the research and share their traffic, 21 October 2026, 20:00 to 23:00 UTC. Data prepared by the OneFirewall SOC team.
- The numbers count attempts, not confirmed compromises.
- Scores are the crime score each IP had at the time of each event.
- Only opted-in members are included, so the numbers understate the real size of the wave across the internet.
- The last octet of every IPv4 address is masked.