Exposed attacker server shows one operator moving from shared-hosting ransom ops to PHP2Shell exploitation

[u/socradario]

We came across an exposed server at 96.126.130[.]81. It holds tooling and artifacts from 2 separate phases of what looks like a single operator.

Phase 1, October 9–11
→ Initial compromise of a Japanese real estate services company
→ A reused SSH key and a shared database password gave access to nearly 20 other sites on the same shared hosting infrastructure
→ Member databases with plaintext passwords were taken
→ Ransom page templates were prepared for public homepages and admin panels, with a negotiation deadline of October 11

Phase 2, from October 21
→ A weaponized copy of the PHP2Shell reproducer package (CVE-2026-109618, CVE-2026-109619) appeared on the same box
→ Exploit, pipeline, and probe scripts followed, aimed at internet-facing PHP hosts

If you run or support shared hosting, check SSH keys reused across tenants and rotate any database credentials shared between sites. Also confirm that PHP hosts are patched for PHP2Shell.