PHP2Shell exploitation observed: packet-to-process RCE evidence

A honeypot operator published packet and Tetragon evidence of PHP2Shell remote code execution on 24 October. Across three PHP 8.4.26 targets, 35 execution-stage POSTs matched 35 Apache-parent /bin/sh starts, from two source IPs that the report does not attribute to separate actors. The four-stage chain resembles a public HTTP-only PoC and used leaked memory addresses to adjust the final request. The setup was a favorable single-worker mod_php configuration, so it says nothing about reliability elsewhere. The report's figures are self-reported and unchecked independently.