Threat landscape

What reaches my own server?

Period for the whole page

Last 7 days: from 24.10.2026 until today, 7:00, updated hourly. Applies to all figures and charts on this page. I do not keep the data longer than 90 days.

Around 3.400 attack attempts in 7 days. On a single small server.

This is the server this website runs on. I counted requests my firewall blocked and requests for files that don't exist here. Almost all of it comes from programs that comb the entire internet around the clock. Nobody picked secureIT. Every business with a website, router or mail server gets hit exactly the same way, however small.

550

attempts per day on average

350

different senders

66

countries

0,1 %

from known research scanners

Period: last 7 days, from 24.10.2026 to 30.10.2026, 7:00, as selected above.

PHP2Shell: what of it reaches my server

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a critical flaw in PHP, the programming language behind roughly three quarters of all websites, WordPress and many online shops included. Known since 21 October 2026, exploited even earlier. The attacker sends a crafted file upload. PHP takes it apart before the actual website runs, and in the process someone else's code can get onto the server. These four figures show what of it reaches me, from the clearest sign to the background noise.

8

Uploads to addresses without an upload function

The clearest sign of PHP2Shell. A normal visitor never sends a file to these addresses because the page there accepts none. But PHP processes an upload at any address before the actual page even runs. That processing is exactly where the flaw lies.

2

Manipulated uploads

Uploads with a deliberately distorted structure, for example broken or missing separators between the files. The firewall blocks them. PHP2Shell needs exactly such distorted uploads to throw PHP off balance while it takes them apart.

15

Malicious PHP code and system commands

Requests containing PHP code or commands for the server. If an attack like PHP2Shell succeeds, this is exactly the code meant to run afterwards.

about 3.000

Searching for PHP files

Not PHP2Shell but the background noise: bots request PHP files that don't exist here, mostly backdoors and WordPress logins. Some of them look for exactly the backdoors left behind on a server after a successful break-in such as PHP2Shell.

Whether a single hit really was PHP2Shell cannot be proven from the outside. My server is patched.
Do you run PHP on your own servers? The critical PHP2Shell flaw from October 2026 is fixed from PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older versions are vulnerable.

Period: last 7 days, from 24.10.2026 to 30.10.2026, 7:00, as selected above. I have only been counting uploads since 29.10.2026; before that, only the firewall's hits appear there.

What was attempted

  • Hunting for backdoors about 1.550

    Requests for files with typical web shell names. Bots hope to stumble on a backdoor that another attacker left on the server earlier.

  • WordPress attacks about 1.350

    Login attempts with guessed passwords and searches for vulnerable plugins. My server doesn't even run WordPress, but the bots try anyway.

  • Hunting for credentials about 250

    Attempts to fetch configuration files with passwords and keys that are left exposed on poorly set-up websites.

  • Suspicious bot requests about 110

    Requests that break the rules of the web or carry the typical traits of simple scanning scripts.

  • Probing the server about 70

    Requests for test and status pages to learn software versions and pick matching flaws.

  • Injecting code about 40

    Requests carrying malicious code: SQL commands against the database, shell commands, scripts or manipulated uploads meant to make the server run someone else's code.

  • Flaws in other software about 19

    Known flaws in programs, routers and firewalls I don't even use. Scanners try them blindly on every address on the internet.

  • Admin tools about 8

    Searches for openly reachable database and file managers.

  • Other about 7

    Other blocked or dead-end requests without a clear pattern.

Period: last 7 days, from 24.10.2026 to 30.10.2026, 7:00, as selected above.

Every day, every hour

24.10.30.10.2026

Period: last 7 days, from 24.10.2026 to 30.10.2026, 7:00, as selected above. One bar per day; today's is not complete yet.

0 h12 h23 h

Period: last 7 days, from 24.10.2026 to 30.10.2026, 7:00, as selected above. Per hour of the day in German time, added up over all days.

There is no quiet hour: these programs know neither evenings off nor weekends.

Where the sending computers are located

Fiji Tanzania Western Sahara Canada: 13 attack attempts USA: 84 attack attempts Kazakhstan: 3 attack attempts Uzbekistan: 5 attack attempts Papua New Guinea Indonesia: 2 attack attempts Argentina: 24 attack attempts Chile: 6 attack attempts Congo - Kinshasa Somalia Kenya: 3 attack attempts Sudan Chad Haiti Dominican Republic Russia: 22 attack attempts Bahamas: 2 attack attempts Falkland Islands Norway Greenland Timor-Leste South Africa: 9 attack attempts Lesotho Mexico: 21 attack attempts Uruguay Brazil: 20 attack attempts Bolivia Peru Colombia: 4 attack attempts Panama Costa Rica Nicaragua Honduras: 2 attack attempts El Salvador Guatemala Belize Venezuela: 5 attack attempts Guyana Suriname France: 65 attack attempts Ecuador Puerto Rico Jamaica: 2 attack attempts Cuba Zimbabwe: 1 attack attempts Botswana Namibia Senegal Mali Mauritania Benin Niger: 2 attack attempts Nigeria Cameroon Togo Ghana Côte d’Ivoire: 1 attack attempts Guinea Guinea-Bissau Liberia Sierra Leone Burkina Faso: 1 attack attempts Central African Republic Congo - Brazzaville Gabon: 1 attack attempts Equatorial Guinea Zambia Malawi Mozambique Eswatini Angola Burundi Israel: 2 attack attempts Lebanon Madagascar Palestinian Territories Gambia Tunisia: 1 attack attempts Algeria Jordan United Arab Emirates: 6 attack attempts Qatar Kuwait Iraq Oman: 1 attack attempts Vanuatu Cambodia Thailand: 3 attack attempts Laos Myanmar (Burma) Vietnam: 15 attack attempts North Korea South Korea: 659 attack attempts Mongolia India: 37 attack attempts Bangladesh: 13 attack attempts Bhutan Nepal: 2 attack attempts Pakistan: 6 attack attempts Afghanistan Tajikistan Kyrgyzstan Turkmenistan Iran Syria: 1 attack attempts Armenia: 2 attack attempts Sweden Belarus: 5 attack attempts Ukraine: 17 attack attempts Poland: 60 attack attempts Austria Hungary Moldova Romania Lithuania Latvia Estonia Germany: 213 attack attempts Bulgaria Greece Turkey Albania Croatia Switzerland: 1 attack attempts Luxembourg: 5 attack attempts Belgium: 146 attack attempts Netherlands: 33 attack attempts Portugal: 4 attack attempts Spain: 8 attack attempts Ireland: 11 attack attempts New Caledonia Solomon Islands New Zealand Australia: 524 attack attempts Sri Lanka China Taiwan Italy: 1 attack attempts Denmark United Kingdom: 34 attack attempts Iceland Azerbaijan: 2 attack attempts Georgia Philippines: 7 attack attempts Malaysia: 18 attack attempts Brunei Slovenia Finland: 2 attack attempts Slovakia Czechia Eritrea Japan Paraguay: 3 attack attempts Yemen Saudi Arabia: 4 attack attempts Cyprus Morocco: 4 attack attempts Egypt Libya Ethiopia Djibouti Uganda Rwanda Bosnia & Herzegovina North Macedonia Serbia Montenegro Trinidad & Tobago: 2 attack attempts South Sudan Singapore: 609 attack attempts Hong Kong: 605 attack attempts
fewmany

Period: last 7 days, from 24.10.2026 to 30.10.2026, 7:00, as selected above.

  • South Koreaabout 650
  • Singaporeabout 600
  • Hong Kongabout 600
  • Australiaabout 500
  • Germanyabout 200
  • Belgiumabout 150
  • USAabout 80
  • Franceabout 70

The country shows where the computer is, not where the person behind it sits. Attackers rent machines in other people's data centres or use hijacked routers and PCs. So be careful with conclusions like “the attacks come from country X”.

Source: my own analysis of the secureit.icu server logs. Large figures rounded. I deliberately do not publish individual addresses, requests or firewall settings. Countries: IP Geolocation by DB-IP (CC BY 4.0).

By advisories

And which flaws are currently known?

The attacks target known flaws. Which software in businesses is currently affected, where it sits in the building and what is already being exploited is shown in the view by advisories, with the warnings from BSI and CISA.

To the view by advisories →

Set up in an hour, trained in a week.

Create a free account, add your team, unlock the course. You only pay when you start. Would you rather see what a test email looks like first? The self-test is free.

Add your team Test it yourself first