Back to evidence

Sanitized live incident

Confirmed compromise

Native source identity and targetable endpoints are private.

criticalconfirmed
Confidence
100%
First seen
Oct 11, 7:56:56 AM PDT
Evidence through
Oct 12, 10:08:16 AM PDT
AI status
Pending
AI investigation is Pending

Deterministic signals remain live while the bounded assessment completes.

Observed impact

  • Remote command execution
  • Root execution
  • Server identity disclosure
  • System information disclosure

Deterministic signals

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

9360 observations · 8 http
Http.server command output100%

Exploit request received non-reflected process identity output

10 observations · 10 http
Http.server kernel output84%

Response contains non-reflected kernel identification

2 observations · 2 http
Http.server os release output84%

Response contains non-reflected operating-system release data

1 observations · 1 http
Http.command injection attempt88%

Request contains shell metacharacters and command tokens

1 observations · 1 http