🚨 #PHP2Shell (CVE-2026-109618, CVE-2026-109619): everyone is staging the leaked PHP RCE, no one has landed it 🫠 We mapped the exposed PHP footprint and went into the attacker open directories after the Oct 21 leak. What we found: → 683,922 IPs leaking a PHP version in one day of scans, mostly end-of-life builds → ~a dozen open-dir workspaces staging php2shell tooling, zero victims or shells in any of them → one mass operator sprayed up to 123 servers via a ~97-proxy farm, zero shells → scanning started ~20 min after the patch, driven by an existing Mirai-style botnet → no public PoC lands code exec on x86-64 yet (OOM corruption vs ASLR) Patch now: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Full research + network observables: hunt.io/blog/php2shell-cve-2…

📌 Hunting BraZetsu Infrastructure Through TLS Certificates A couple of weeks ago, we published our hunt into BraZetsu infrastructure, starting from a previously reported seed IP and following the TLS trail. Using HuntSQL, we mapped certificate history, pivoted on naming patterns, and uncovered 80.78.27[.]252, where c2.installscenter[.]com appeared on port 2083 alongside painel.installscenter[.]com on 8083 and 8443. The infrastructure changed providers, but the painel./c2. naming and Hestia Control Panel setup stayed remarkably consistent. Read the full article on our blog 👉 hunt.io/blog/brazetsu-access… #ThreatHunting #ThreatIntel #CyberSecurity

🔍 Explore the Files Behind Active Threat Infrastructure What can an exposed attacker directory tell you beyond a few IOCs? AttackCapture gives analysts a deeper look at the files, tooling, and artifacts attackers leave behind on live infrastructure. You can search code and text across archived files, identify credentials, review sandboxed content, map findings to MITRE ATT&CK techniques, and explore servers behaving like C2s. Our team also adds hand-written observations to notable directories, helping analysts quickly understand what may be worth investigating further. Get a demo and see AttackCapture in action 👉 hunt.io/get-started #ThreatHunting #ThreatIntel #CyberSecurity

🕵️‍♂️ Pivot From Targeted Industries to Actor Infrastructure Do you know which threat actors are targeting the sector you care about? We can help with that. On our platform, you can filter the threat actor dataset by sector, open a matching profile, and review the activity tied to that actor. In this example, we start with Information Technology, narrow the list to actors tied to that sector, and land on WageMole, a North Korean state-sponsored group. From there, we can pivot into its IPs, hosts, SHA256s, and related activity. See which actors are targeting your sector 👉 hunt.io/get-started #ThreatHunting #ThreatIntel #CyberSecurity

🚀 Go Beyond a List of C2 IPs A C2 IP is useful, but knowing what sits around it is much better. Our C2 feeds include host-level context that helps connect infrastructure to malware families, threat actors, domains, JA4 fingerprints, and related systems. That gives analysts more places to pivot without starting from a static IOC and doing the enrichment by hand. Our platform also uses 150+ detection techniques to identify malicious behavior across the infrastructure we track. Ready to explore the latest 7 days of C2 feed data with our two-week free trial? Apply here 👉 hunt.io/oem-c2-threat-feeds #ThreatIntel #ThreatHunting

🎯 Find Infrastructure Reused Across Multiple Malware Campaigns A simple HuntSQL query can be surprisingly strong for finding reused infrastructure. The query from the first screenshot finds the top 10 IPs associated with the highest number of unique malware families over the last 30 days. That quickly highlights hosts reused across multiple malware campaigns. From the results, we can open a matching IP and move straight into its network context, risk signals, open ports, software, and active malware to keep expanding the investigation. Use this query to start your next hunt 👉 hunt.io/get-started #ThreatHunting #ThreatIntel #CyberSecurity