SOCRadar

“Taken together, the toolset points to a financially motivated actor focused on cryptocurrency and Web3 targets.”

SOCRadar · said date not stated · reported 2026-10-23

SOCRadar assessed the toolset as pointing to a financially motivated actor targeting cryptocurrency and Web3.

“The central file, aslr_exploit.py, is a Python exploit the operator labels a 'one-click' PHP2Shell exploit for PHP 8.4.26 under Apache mod_php,”

SOCRadar · said date not stated · reported 2026-10-23

SOCRadar found a Python exploit tool on an exposed attacker-controlled server targeting PHP 8.4.26.

“It works entirely over ordinary HTTP requests in three broad steps: it recycles the target's PHP worker, leaks memory addresses through the session cookie to defeat address space layout randomization (ASLR), and then abuses PHP's session upload progress handling to run a shell command.”

SOCRadar · said date not stated · reported 2026-10-23

SOCRadar described how the exploit works over HTTP requests to bypass ASLR and execute shell commands.

“Related artifacts on the server additionally point to web-archive reconnaissance and automated CAPTCHA solving,”

SOCRadar · said date not stated · reported 2026-10-23

SOCRadar noted that related artifacts on the attacker server indicated web-archive reconnaissance and automated CAPTCHA solving.