I reconfigured nginx on one of my servers to log all attempted multipart POST requests. Been tailing the log, and while there is a trickle of entries, they all are for empty forms, none are php2shell specific.
Interestingly enough, virtually all of these come from the Google Cloud IP space. There was a single hit from China and two from Europe.
Interestingly enough, virtually all of these come from the Google Cloud IP space. There was a single hit from China and two from Europe.