Honeypot catches suspected RCE within 26 hours of going live
moyix · x · 2026-10-25
Security researcher 0x4D31 reports that the phpot honeypot, with just 6 sensors, recorded repeated leak-stage attempts, distributed probes, and a 38-request serializer-testing wave within its first 26+ hours — 30 OOMs and 11 worker crashes, though no confirmed RCE yet.
A Tetragon alert (screenshot) shows apache2 spawning /bin/sh as UID 33 during a native POST sequence from 15.204.59.70, alongside oversized cookies, memory exhaustion, sensitive file operations, and two worker crashes. Missing parent-worker attribution means exact request attribution and successful writes remain unverified; investigation is ongoing.
More from Safety
- AI cyber defense worked: Team Defense found and patched bugs first — kuza55 · 2026-10-25
- Centralized databases are low-hanging fruit for agents, argues self-custody advocate — StewartalsopIII · 2026-10-25
- How LLM-based penetration testing harnesses work: LLM plans, harness executes — utku1337 · 2026-10-25
- Show HN: Argus, an open source security platform against agentic attacks — thomasunise · 2026-10-25
- Leak: OpenAI quietly restarted frontier training Oct 1 with offline web; agents found Brotli RCE — mark_k · 2026-10-25
- AI security research finds only known bug classes — but with '10,000x' the time — yacineMTB · 2026-10-25