Adel Karimi

Reported Context (4)

Detection and response lead at Perplexity who confirmed successful remote code execution against honeypot systems on October 24, 2026. CISA Adds Actively Exploited PHP2Shell Flaws to KEV Catalog
Perplexity researcher who recorded what appeared to be the first in-the-wild successful exploitation of the PHP vulnerabilities on honeypot servers. Scanner-Evading JavaScript Campaign Targets 953 Online Stores, Mostly Magento
Perplexity researcher whose honeypots recorded shell execution; he reported the activity as consistent with exploitation of CVE-2026-109618 and cautioned that the results reflected a specific single-worker mod_php setup. PHP2Shell Exploitation Reaches Working Shells on Honeypots
Detection and response lead at Perplexity whose honeypots recorded evidence of confirmed PHP2Shell remote code execution. PHP2Shell RCE Flaws Confirmed Exploited in the Wild

CVE (6)

People (1)

MITRE ATT&CK (6)

Vendors (1)

Products (6)

Industries (1)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.