Sanitized live incident
Attempted exploitation
Native source identity and targetable endpoints are private.
highopen
- Confidence
- 88%
- First seen
- Aug 14, 5:56:03 PM PDT
- Evidence through
- Aug 14, 6:17:19 PM PDT
- AI status
- Outside window
AI investigation is Outside window
Deterministic signals remain live while the bounded assessment completes.
Observed impact
- Shell spawned
- Workload root shell
Deterministic signals
Request contains shell metacharacters and command tokens
535 observations · 12 httpA shell process appeared in the correlated workload and request window
3 observations · 3 process