Hacker News Reader

Just last week companies were saying php2shell has been rampant for months, but if that were the case, wouldn't we all have strange errors in our logs? Something seems fishy to me.

View on HN

Which companies? The earliest claim of an exploit attempt in the wild I had heard was October 17th, and that was “extant”, not “rampant”.

I don’t suppose you’re thinking of when the issue was discovered? That was August 1st, according to https://calif.io/php2shell/#the-discovery.

Amazon said 4 days prior to patch, but I'm pretty sure the other one was cloudflare, I can't find the link in my browser history.

So was “months” a typo for “4 days” or what?

Both of those are coming from telemetry, and mainly show attempts. Those telemetry are generally heuristic based so they overcount and are most often unsuccessful - it took much layer for actual honeypots to be hit. See my timeline in my other comment if you’re interested in details and extract dates

4 days is a month now is it?

Should we expect logs from a compromised system to be truthful?

No, of course not. Covering your tracks by manipulating logs and monitoring tools is stuff any sophisticated attacker would do

Perhaps if those logs were streamed to a non-compromised machine and stored there

And how do we know the logs that are emitted are trustworthy?

Reply on news.ycombinator.com