Threat landscape

What reaches my own server?

Period for the whole page

Last 90 days: from 02.08.2026 until today, 8:00, updated hourly. Applies to all figures and charts on this page. I do not keep the data longer than 90 days.

Around 45.000 attack attempts in 90 days. On a single small server.

This is the server this website runs on. I counted requests my firewall blocked and requests for files that don't exist here. Almost all of it comes from programs that comb the entire internet around the clock. Nobody picked secureIT. Every business with a website, router or mail server gets hit exactly the same way, however small.

500

attempts per day on average

1.500

different senders

112

countries

under 0,1 %

from known research scanners

Period: last 90 days, from 02.08.2026 to 30.10.2026, 8:00, as selected above.

PHP2Shell: what of it reaches my server

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a critical flaw in PHP, the programming language behind roughly three quarters of all websites, WordPress and many online shops included. Known since 21 October 2026, exploited even earlier. The attacker sends a crafted file upload. PHP takes it apart before the actual website runs, and in the process someone else's code can get onto the server. These four figures show what of it reaches me, from the clearest sign to the background noise.

8

Uploads to addresses without an upload function

The clearest sign of PHP2Shell. A normal visitor never sends a file to these addresses because the page there accepts none. But PHP processes an upload at any address before the actual page even runs. That processing is exactly where the flaw lies.

2

Manipulated uploads

Uploads with a deliberately distorted structure, for example broken or missing separators between the files. The firewall blocks them. PHP2Shell needs exactly such distorted uploads to throw PHP off balance while it takes them apart.

15

Malicious PHP code and system commands

Requests containing PHP code or commands for the server. If an attack like PHP2Shell succeeds, this is exactly the code meant to run afterwards.

about 42.000

Searching for PHP files

Not PHP2Shell but the background noise: bots request PHP files that don't exist here, mostly backdoors and WordPress logins. Some of them look for exactly the backdoors left behind on a server after a successful break-in such as PHP2Shell.

Whether a single hit really was PHP2Shell cannot be proven from the outside. My server is patched.
Do you run PHP on your own servers? The critical PHP2Shell flaw from October 2026 is fixed from PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older versions are vulnerable.

Period: last 90 days, from 02.08.2026 to 30.10.2026, 8:00, as selected above. I have only been counting uploads since 29.10.2026; before that, only the firewall's hits appear there.

What was attempted

  • Hunting for backdoors about 31.000

    Requests for files with typical web shell names. Bots hope to stumble on a backdoor that another attacker left on the server earlier.

  • WordPress attacks about 10.000

    Login attempts with guessed passwords and searches for vulnerable plugins. My server doesn't even run WordPress, but the bots try anyway.

  • Hunting for credentials about 2.300

    Attempts to fetch configuration files with passwords and keys that are left exposed on poorly set-up websites.

  • Probing the server about 450

    Requests for test and status pages to learn software versions and pick matching flaws.

  • Flaws in other software about 250

    Known flaws in programs, routers and firewalls I don't even use. Scanners try them blindly on every address on the internet.

  • Other about 120

    Other blocked or dead-end requests without a clear pattern.

  • Suspicious bot requests about 110

    Requests that break the rules of the web or carry the typical traits of simple scanning scripts.

  • Admin tools about 90

    Searches for openly reachable database and file managers.

  • Injecting code about 40

    Requests carrying malicious code: SQL commands against the database, shell commands, scripts or manipulated uploads meant to make the server run someone else's code.

Period: last 90 days, from 02.08.2026 to 30.10.2026, 8:00, as selected above.

Every day, every hour

02.08.30.10.2026

Period: last 90 days, from 02.08.2026 to 30.10.2026, 8:00, as selected above. One bar per day; today's is not complete yet.

0 h12 h23 h

Period: last 90 days, from 02.08.2026 to 30.10.2026, 8:00, as selected above. Per hour of the day in German time, added up over all days.

There is no quiet hour: these programs know neither evenings off nor weekends.

Where the sending computers are located

Fiji Tanzania Western Sahara Canada: 8.034 attack attempts USA: 2.099 attack attempts Kazakhstan: 3 attack attempts Uzbekistan: 8 attack attempts Papua New Guinea Indonesia: 29 attack attempts Argentina: 35 attack attempts Chile: 17 attack attempts Congo - Kinshasa Somalia Kenya: 5 attack attempts Sudan Chad Haiti Dominican Republic: 1 attack attempts Russia: 39 attack attempts Bahamas: 2 attack attempts Falkland Islands Norway: 1.163 attack attempts Greenland Timor-Leste South Africa: 16 attack attempts Lesotho Mexico: 674 attack attempts Uruguay Brazil: 439 attack attempts Bolivia: 1 attack attempts Peru Colombia: 10 attack attempts Panama Costa Rica: 2 attack attempts Nicaragua Honduras: 2 attack attempts El Salvador Guatemala: 1 attack attempts Belize Venezuela: 6 attack attempts Guyana Suriname France: 154 attack attempts Ecuador: 2 attack attempts Puerto Rico: 2 attack attempts Jamaica: 2 attack attempts Cuba Zimbabwe: 3 attack attempts Botswana Namibia Senegal: 2 attack attempts Mali Mauritania Benin: 2 attack attempts Niger: 2 attack attempts Nigeria: 2 attack attempts Cameroon: 1 attack attempts Togo: 2 attack attempts Ghana: 2 attack attempts Côte d’Ivoire: 1 attack attempts Guinea Guinea-Bissau Liberia Sierra Leone Burkina Faso: 1 attack attempts Central African Republic Congo - Brazzaville Gabon: 1 attack attempts Equatorial Guinea Zambia: 2 attack attempts Malawi Mozambique Eswatini Angola Burundi Israel: 5 attack attempts Lebanon Madagascar Palestinian Territories: 2 attack attempts Gambia Tunisia: 1 attack attempts Algeria Jordan United Arab Emirates: 16 attack attempts Qatar: 5 attack attempts Kuwait Iraq: 3 attack attempts Oman: 5 attack attempts Vanuatu Cambodia: 1 attack attempts Thailand: 8 attack attempts Laos Myanmar (Burma): 1 attack attempts Vietnam: 60 attack attempts North Korea South Korea: 7.654 attack attempts Mongolia India: 5.021 attack attempts Bangladesh: 36 attack attempts Bhutan Nepal: 6 attack attempts Pakistan: 21 attack attempts Afghanistan: 2 attack attempts Tajikistan Kyrgyzstan Turkmenistan Iran Syria: 1 attack attempts Armenia: 2 attack attempts Sweden: 627 attack attempts Belarus: 5 attack attempts Ukraine: 43 attack attempts Poland: 959 attack attempts Austria: 8 attack attempts Hungary Moldova Romania: 4 attack attempts Lithuania: 9 attack attempts Latvia: 2 attack attempts Estonia Germany: 1.831 attack attempts Bulgaria: 5 attack attempts Greece Turkey: 29 attack attempts Albania: 1 attack attempts Croatia: 2 attack attempts Switzerland: 1.066 attack attempts Luxembourg: 61 attack attempts Belgium: 1.027 attack attempts Netherlands: 307 attack attempts Portugal: 4 attack attempts Spain: 454 attack attempts Ireland: 21 attack attempts New Caledonia Solomon Islands New Zealand: 2 attack attempts Australia: 5.318 attack attempts Sri Lanka: 1 attack attempts China: 20 attack attempts Taiwan: 16 attack attempts Italy: 570 attack attempts Denmark United Kingdom: 460 attack attempts Iceland Azerbaijan: 7 attack attempts Georgia: 2 attack attempts Philippines: 11 attack attempts Malaysia: 31 attack attempts Brunei Slovenia: 7 attack attempts Finland: 16 attack attempts Slovakia: 2 attack attempts Czechia: 2 attack attempts Eritrea Japan: 2.028 attack attempts Paraguay: 3 attack attempts Yemen Saudi Arabia: 11 attack attempts Cyprus Morocco: 18 attack attempts Egypt: 4 attack attempts Libya Ethiopia: 3 attack attempts Djibouti Uganda: 2 attack attempts Rwanda Bosnia & Herzegovina North Macedonia: 1 attack attempts Serbia: 1 attack attempts Montenegro: 1 attack attempts Trinidad & Tobago: 4 attack attempts South Sudan Singapore: 839 attack attempts Hong Kong: 3.014 attack attempts
fewmany

Period: last 90 days, from 02.08.2026 to 30.10.2026, 8:00, as selected above.

  • Canadaabout 8.000
  • South Koreaabout 7.700
  • Australiaabout 5.300
  • Indiaabout 5.000
  • Hong Kongabout 3.000
  • USAabout 2.100
  • Japanabout 2.000
  • Germanyabout 1.850

The country shows where the computer is, not where the person behind it sits. Attackers rent machines in other people's data centres or use hijacked routers and PCs. So be careful with conclusions like “the attacks come from country X”.

Source: my own analysis of the secureit.icu server logs. Large figures rounded. I deliberately do not publish individual addresses, requests or firewall settings. Countries: IP Geolocation by DB-IP (CC BY 4.0).

By advisories

And which flaws are currently known?

The attacks target known flaws. Which software in businesses is currently affected, where it sits in the building and what is already being exploited is shown in the view by advisories, with the warnings from BSI and CISA.

To the view by advisories →

Set up in an hour, trained in a week.

Create a free account, add your team, unlock the course. You only pay when you start. Would you rather see what a test email looks like first? The self-test is free.

Add your team Test it yourself first