Black Hills Information Security
- Aliases / services
- Black Hills Information Security / BHIS / ActiveSOC / blackhillsinfosec.com
- Official website
- https://www.blackhillsinfosec.com/
Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.
Response status by service
ActiveSOC PHP2Shell detection support
- Response status
- Linux and Windows detection rules published
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Penetration testing and security monitoring.
The 23 October post provides two rules and Sigma versions for shells spawned by web workers.
Scope: Linux testing was isolated; Windows simulated post-exploitation behavior. Neither is a customer-breach report.
What users should do
Patch PHP and test/tune the rules against your own telemetry.
Official service URL
Source URLs
- PHP2Shell response and scopehttps://activesoc.blackhillsinfosec.com/blog/php2shell-in-the-lab-and-where-a-soc-catches-it/Response evidence
Related official sources
- PHP2Shell response and scopeOfficial notice
Comments