MatrixMonitor: Tracking 295 IPs During PHP2Shell Crisis
Analyzing a 27-page threat report from a 3D globe dashboard creator, detailing the October 2026 PHP runtime vulnerability and attacker statistics.
Stock photo for illustration only, not from the actual event
- PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) carry a CVSS score of 9.2
- MatrixMonitor logged 295 unique attacker IPs across 49 countries from October 20-22, 2026
- US-hosted servers led the attack sources, with Germany, the US, and France as top victims
- Real-world data pressure revealed five major design flaws in the dashboard itself
The global internet experienced a massive jolt this week following the public disclosure of two critical memory-safety bugs in the PHP runtime on October 21, 2026, which allowed unauthenticated attackers to execute remote code. MatrixMonitor, a personal side project visualizing top attackers on a 3D globe, exported three days of historical data (October 20-22 UTC) to compile a 27-page threat report covering system mechanics, incident statistics, and the behavior of 295 distinct attacker IPs.
MatrixMonitor operates through a .NET worker that pulls the AbuseIPDB blacklist, geolocates IPs offline using MaxMind, and enriches the top 100 with the past 24 hours of reports to classify attacks like brute-force, SSH abuse, and web application probes. Although initial plans included ML.NET spike detection and live Server-Sent Events, this week's heavy data traffic strongly justified the necessity of those planned features.
Stock photo for illustration only, not from the actual event
The vulnerabilities, collectively named PHP2Shell, consist of CVE-2026-109618 and CVE-2026-109619, both rated with a severe CVSS v4.0 score of 9.2. The underlying issue stems from code dating back to PHP 5.4 in 2012, meaning fully updated WordPress, Drupal, or Joomla sites remained vulnerable if the underlying PHP runtime was unpatched. Cloudflare recorded tens of thousands of attempts within 45 minutes of disclosure, surging into the millions by October 22. While no confirmed successful remote code executions were reported in the wild, multiple government, school, and corporate services went offline precautionary. The remedy requires upgrading PHP and restarting the web server workers.
Across three daily snapshots, MatrixMonitor recorded 300 high-confidence listings comprising 295 unique IPs from 49 countries attacking 69 nations, all holding a 100 confidence score on AbuseIPDB. US-hosted IPs led daily counts, while China's count halved from 17 to 9. Regionally, East Asia, Europe, and North America tied closely at 25%, 24%, and 24% respectively. However, hosting countries reflect infrastructure location rather than operator nationality, as many attackers leverage rented cloud VMs or VPS instances to drive automated botnets spraying the global web.
In-depth analysis reveals that high attack volumes stem from automated botnets indiscriminately spraying the entire internet rather than targeted human hacks. Furthermore, hosting countries like Germany, the US, and France often rank high as victims partly because they host numerous security vendors, honeypots, and active reporting entities, skewing regional statistics based on where reports originate.
Comparing the export data with findings from Amazon, Wordfence, and Sophos revealed two key leads, including shared network neighborhoods and Google Cloud probing patterns in Belgium. Ultimately, the most significant takeaway for the developer was not about the attackers, but uncovering five crucial design flaws in MatrixMonitor that only extreme real-world data loads could expose.
Source: Dev.to
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment