Plan
active
PHP2Shell Exploitation Scanning Continues; Unit 42 Retracts Gov Agency Attribution
- Engineer — Plan: Active global scanning targeting PHP applications is reported even as the specific government agency incident attribution was walked back; audit deployed PHP apps for unpatched vulnerabilities and verify WAF rules cover known PHP exploitation patterns this quarter.
- SOC/IR — Learn: The original attribution tying post-compromise activity at a European government agency to PHP2Shell has been retracted; no confirmed IOCs or TTPs are available in this update, so hold detection work until corroborated threat intel with actionable indicators emerges.
- Leader — Learn: A suspected North Korean global scanning campaign is noted, but the specific incident attribution was revised mid-reporting; the shifting assessment means this does not yet warrant a leadership briefing or vendor exposure check — monitor for a confirmed, corroborated report.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.