OTX Threat: PHP2Shell Weaponized After Japanese Real Estate Extortion

An exposed staging server at 96.126.130.81 revealed an operator's extortion campaign targeting Japanese real estate websites between October 9-11, 2026, followed by PHP2Shell exploitation tooling. The operator, using the handle kkkkevin777, compromised one Japanese real estate services company and pivoted to nearly 20 related sites through shared hosting credentials. Stolen data included 16,061 cu CVEs: CVE-2026-109618, CVE-2026-109619 Sectors: Real Estate, Finance