TI-2026-095C — The Weaponizers: The Sixteen Edges the Graph Will Vouch For

Classification: HIGH · Forensic threat intelligence · Honeypot + web-threats · Entity-graph-derived · Series: Below the Noise Floor

Ask a vulnerability scanner what is dangerous and it will drown you: every host is exposed to something, every banner maps to a CVE, the exposure map runs to six figures. But exposure is not attack. A machine that could be exploited is not the same as a machine being exploited, and the whole art of triage is telling the two apart. This dossier is what happens when the intelligence graph is finally able to draw that line in its own edges. Across 985,859 entities and 1,715,876 relationships, the graph records 92,869 vulnerable_to edges — things that could be hit — and exactly 16 targets edges: an IP caught pulling the trigger. Sixteen. This is the story of those sixteen edges, the fourteen addresses behind them, and the reason they were invisible until this week.

1. Two New Instruments

Most of the Shuffle-On corpus was written from a single sensor: an SSH honeypot that watches attackers at Layer 4 — who logs in, what they type, what they drop. That sensor is superb at its job and blind to everything that never speaks SSH. The largest category it cannot see is the one that defines the modern internet's background radiation: web-application exploitation — the endless HTTP requests probing for a vulnerable PHP file, a mis-deployed framework, an exposed actuator.

Two capabilities changed that, and both are days old at the time of writing.

The first is a web-threats CVE-correlation engine (ip_cve_correlations). It parses the Traefik Layer-7 request stream against a dictionary of exploit signatures — request paths, methods, and body patterns that map to specific CVEs — and records, per source IP, which exploit it attempted, against which host, how many times, with what confidence, and whether the match was attributed (a high-confidence, structurally-specific hit rather than a loose path guess).

The second is the golden entity graph — a resolved store of 985,859 entities (IPs, ASNs, subnets, domains, CVEs, orgs, people) knitted together from 21 sources into 1.7 million edges. Crucially, its relationships are directional and typed. Among them are two that concern CVEs, and they are opposites:

• vulnerable_to — posture. An entity is exposed to a CVE, usually inferred from a service banner. This is the "could be exploited" relationship, and it is everywhere: 92,869 edges.
• targets — offense. An IP is actively weaponizing a CVE against others. This is the "is exploiting" relationship, and the graph will only assert it on the strongest evidence. It exists on 16 edges in the entire store.

The engine finds the exploit attempts; the graph decides which of them are trustworthy enough to promote from noise into a first-class offensive fact. This dossier is the first reading of that offensive slice — and it turns out to be sixteen edges wide.

2. The Scarcity Is the Signal

It is worth sitting with the ratio, because it inverts the usual relationship between a security tool and its user. Vulnerability tooling fails by over-reporting: it hands you ten thousand findings and calls prioritization your problem. A graph that recorded 92,869 offensive edges would be exactly that failure at a larger scale — an undifferentiated hostility cloud, useless for action.

Instead the offensive direction is four orders of magnitude smaller than the posture direction. That is not the graph being incomplete. It is the graph being disciplined. The 92,869 vulnerable_to edges are honest but cheap — they say only that a banner matched a known-vulnerable version. The 16 targets edges are expensive: each one required the CVE engine to observe an actual exploit attempt, at high confidence, attributed, and for the graph's coalescence rule to accept the promotion. Sixteen is what first-party, evidence-gated offense looks like when you refuse to conflate it with exposure.

All sixteen edges carry source = 'honeypot' pipeline provenance, confidence = 0.95, and observation timestamps clustered in a single recent window: 2026-07-19 through 2026-07-22. They are new because the capability that mints them is new. And they resolve, when you follow each edge from its source IP to its destination CVE, to fourteen distinct addresses and three vulnerabilities.

3. The Three Exploits

Every one of the sixteen targets edges points at one of three CVEs, and all three are the same kind of thing: a remote-code-execution flaw in a widely-deployed PHP component that should never have been reachable from the web in the first place.

CVE-2017-9841 — PHPUnit eval-stdin.php RCE. PHPUnit is a testing framework; it ships a file, src/Util/PHP/eval-stdin.php, that evaluates PHP read from standard input. If that file is left web-accessible under /vendor/phpunit/… — which happens whenever a project's vendor/ directory is exposed by a webroot misconfiguration — anyone can POST PHP code to it and have the server execute it. The vulnerability is nine years old. It is also, as we will see, the single most-weaponized CVE in the entire web-threats corpus, which tells you everything about how the long tail of web RCE actually behaves.

CVE-2021-3129 — Laravel Ignition RCE. Ignition is the pretty error page Laravel shows developers in debug mode. A flaw in its execute-solution endpoint let an attacker abuse a "make view variable" solution to write and execute arbitrary code, provided the application was left in debug mode in production — again, a deployment mistake exposing a developer convenience. Disclosed 2021, still throwing.

CVE-2018-20062 — ThinkPHP invokefunction RCE. ThinkPHP is a PHP framework popular in Asia; a flaw in its routing let an attacker call arbitrary functions (?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&…) and reach system() directly. A textbook unauthenticated RCE that has been a botnet staple since 2018.

Notice the shape they share. None is a memory-corruption zero-day. All three are code paths that were never meant to face the internet, exposed by misconfiguration, and turned into unauthenticated command execution by a single crafted request. This is the economy the weaponizers work in: not the frontier of exploitation, but the vast, permanent installed base of PHP applications deployed slightly wrong.

4. The Wider Field — 318 Probers, 11 CVEs

Before narrowing to the fourteen, it is worth seeing the field they were drawn from, because the graph's restraint only means something against the volume it declined to promote. The CVE engine's full ledger:

Total: 1,541 detections across 318 distinct IPs and 11 CVEs. By head-count, PHPUnit/Laravel/ThinkPHP are not the biggest — Spring Boot Actuator (143 IPs) and Struts2 (66 IPs) dwarf them. Yet only the bottom three were promoted to targets edges. Why?

Because the top of that table is mostly probing, not executing. Spring Boot Actuator detection fires on a request to /actuator/env — that is enumeration of an exposure surface, not code execution. WordPress REST user enumeration is reconnaissance by definition. XML-RPC probes are surface-mapping. These are real, hostile, worth watching — but they are the act of checking whether a door exists, and the graph correctly files them under a lower tier. The PHPUnit/Laravel/ThinkPHP requests are the act of walking through the door and running a command, attributed at 0.95. The promotion rule — attributed and genuine code-execution and high score — is exactly what makes targets worth trusting. The graph looked at 318 probing IPs and vouched for fourteen.

5. The Fourteen

Here is the entire offensive cohort, ranked by exploitation volume, with the real host each one attacked and the infrastructure it fired from:

Read the target column first, because it is the uncomfortable part. These are not abstractions from a threat feed — they are exploit attempts against Cristian's own web surface: the public site www.shuffle-on.com, the self-hosted apps books, taisun, lsn-photos, lsn-pihole, lsn-media, notepad, the dynamic-DNS host lsn-dyn.go.ro, and the raw public IPs 5.14.169.58 / 5.14.167.123. The weaponizers did not target one endpoint; they spread across the entire published estate. 108.137.132.87 alone path-sprayed the PHPUnit endpoint across /admin/, /api/, /app/, /portal/, and /administrator/ mount points at books.shuffle-on.com — trying every place a vendor/ directory might be exposed, 7,480 requests deep.

Two names deserve to be lifted out. 209.182.216.63 (Kamatera) is the heaviest single weaponizer at 10,612 hits and one of only two multi-exploit actors, throwing both PHPUnit and ThinkPHP. 194.164.90.230 (IONOS) is the other, throwing PHPUnit and Laravel, over both GET and POST. Carrying two RCE families is what separates a deliberate operator from an opportunistic scanner running one canned check — these two are running a kit, not a one-liner.

6. The Origin Tells You It Is Rented

Line up the fourteen origins and a pattern falls out immediately: this is cloud. Four of the fourteen are Amazon EC2 (108.137.132.87 in AWS's Jakarta region, plus 3.91.252.169, 18.207.217.188, 54.163.161.231 in the AES/us-east ranges). Add Oracle Cloud (79.72.3.119) and Kamatera (209.182.216.63) and six of fourteen fire from mainstream, by-the-hour VPS providers. The rest fan out across IONOS (Germany), Zenlayer (Netherlands), CDNEXT/Datacamp (UK), CLODO Cloud (UAE), two Indonesian hosters, and China Telecom.

There is exactly one outlier, and it is instructive: 47.166.48.158 sits in AS5650, Frontier Communications — a US residential/SMB ISP, not a datacenter. That single node reads as a compromised home or small-business host repurposed to throw Laravel exploits, in contrast to the thirteen rented boxes around it. It is the shape of the botnet edge: mostly disposable cloud, occasionally a real victim's machine pressed into service.

The cloud concentration is not just a demographic note — it is the remediation story. Bulletproof hosting is what makes a campaign durable; mainstream cloud is the opposite. Every AWS, Oracle, Kamatera, and IONOS node in that table is one abuse report away from termination, and the providers act on RCE-spraying complaints. A weaponizer that fires from ec2 is loud, cheap, and removable. The operators accept that trade because the exploits are commodity and the boxes are fungible — burn one, rent another. But it means the defender's leverage is real: the offensive cohort is takedown-tractable, not untouchable.

7. Invisible Until the Graph Joined the Vectors

Here is the finding that makes this a capability story and not just an IP list. Not one of the fourteen appears in the SSH honeypot. Cross-checked against threat_intel.ips — the store behind every honeypot-derived dossier in this corpus — all fourteen return nothing. They never opened an SSH session. They never typed a command into the sensor. In the honeypot-centric worldview that produced hundreds of prior dossiers, this entire offensive cohort did not exist.

They exist now because the golden entity graph unifies web_threats and honeypot entities under shared IP nodes, so an address that is silent at Layer 4 and loud at Layer 7 finally has a place to be seen. The targets edge is the first offensive relationship that crosses the vector boundary: the CVE engine observes the exploit on the web side, the graph resolves the IP to a single node, and the offense becomes a first-class fact available to the same tooling that reasons about SSH attackers. This dossier is the earliest concrete payoff of that unification — the demonstration that a honeypot-only view systematically under-counts web-application RCE actors, and that the fix is not a bigger honeypot but a graph that lets the two sensors share a subject.

It also reframes the series. Below the Noise Floor has been about rare, single-operator specimens the volume hides — the tunnel scout in the login flood, the bare-socket dropper among the loud droppers. The weaponizers are the same shape at a different layer: fourteen confirmed triggers hidden inside a 92,869-edge exposure map. The noise floor here is posture itself — the ambient hum of everything that could be exploited — and the signal is the sixteen edges the graph will actually stake its confidence on.

8. The Counter-Narrative

Steelman: "This is internet background noise dressed up as a discovery. Fourteen IPs hitting decade-old PHP paths is what every web server on earth sees before breakfast. PHPUnit CVE-2017-9841 is ancient, the exploits are canned, you never confirmed a single one worked, and 'sixteen edges' is just a small database table. Where is the threat?"

Every clause is partly true, and the finding survives all of them:

• Old and commodity does not mean unimportant — it means dominant. The single most-weaponized CVE in the entire corpus is the nine-year-old PHPUnit flaw. The offense is not on the zero-day frontier; it lives in the long tail, harvesting the permanent installed base of mis-deployed PHP. A defensive posture that only watches the newest CVE is watching the wrong end of the distribution. The age of CVE-2017-9841 is the point, not a weakness in it.
• 'You never confirmed success' is a boundary we drew deliberately, and we state it. These are attempts, and this dossier claims attempts. The targeted hosts sit behind Authelia and real services; many exploit paths resolve to nonexistent endpoints; a returned HTTP 200 is a mask, not proof of execution (the whole reason the web-threats pipeline reasons on effective status, not raw codes). We do not assert a breach. We assert fourteen aimed, high-volume, attributed RCE attempts against first-party infrastructure — which is a finding, not a footnote.
• 'Sixteen edges is a small table' is the entire thesis, read backwards. The value is not that the number is big; it is that the number is small and trustworthy. Ninety-two thousand exposure edges are the noise; sixteen offense edges are the signal precisely because the graph refused to promote the other 92,853. A tool that made this table large would be useless. Its smallness is its precision.

What is not claimed: attribution to a named actor or crew (the cohort is defined by behaviour and by the graph's confidence gate, not by a shared operator — the two multi-exploit nodes hint at deliberate operators but that is as far as the evidence reaches, MEDIUM); that any exploit achieved code execution (attempts only); or that fourteen is a complete census of web-RCE actors (it is the complete census of what the graph will vouch for as of this window — the honest floor, not the ceiling).

Confidence: HIGH that these are the sixteen offensive edges in the graph, resolving to fourteen IPs throwing attributed PHPUnit/Laravel/ThinkPHP RCE at real LSN hosts from mostly-rented cloud; MEDIUM on operator identity and on downstream impact (attempt, not confirmed compromise).

9. Defence Response

• Operationalize the offense/posture split. The graph now hands you two tiers for free: vulnerable_to (monitor — it is your exposure map) and targets (act — it is your confirmed-offense feed). Alert and block on targets; do not drown the analyst in vulnerable_to. The fourteen IPs in §5 are a block-list you can apply today, and the two multi-exploit nodes (209.182.216.63, 194.164.90.230) are the priority.
• Report the cloud, because the cloud is the origin. Six of fourteen are AWS/Oracle/Kamatera; abuse reports to those providers are a real, effective control against RCE-spraying EC2 and OCI instances — not a dead letter. The one Frontier residential node should be treated as a likely compromised host, not a datacenter.
• Patch and WAF the long tail, not just the headline CVE. The confirmed weaponization is against /vendor/phpunit/…/eval-stdin.php (PHPUnit), Ignition's execute-solution endpoint (Laravel debug mode in production), and ThinkPHP's invokefunction route. Any web host should ensure vendor/ is not web-reachable, that Laravel debug is off in production, and that these specific paths are blocked at the edge — these are nine-, five-, and eight-year-old flaws that still top the offense list because the installed base never fully patched.
• Join your vectors. The load-bearing lesson: a honeypot-only view missed all fourteen. If you sense at Layer 4 and Layer 7 separately, unify the two under a shared entity so an address that is silent on one and hostile on the other cannot hide in the seam. The weaponizers lived in exactly that seam until the graph closed it.

10. The Bigger Picture

The targets relationship is one new edge type among several the unified graph just gained, and it is the sharpest but not the only one. Alongside it sit multi_vector_operator (584 edges — the same operator seen across SSH and web), coordinates_with (1,612 — behavioural coordination), and the temporal change types owner_changed (9,239) and taken_down (197) that track infrastructure churn over time. Each is a seam waiting to be read the way this dossier read targets: take the rarest, highest-confidence relationship, resolve its endpoints, enrich them, and see who the graph will actually vouch for.

This one vouched for sixteen edges and fourteen addresses. They throw commodity PHP RCE at a homelab's public estate from rented cloud, and they were invisible until the sensors learned to share a subject. That is the whole value of an intelligence graph stated in a single case: not that it knows more things, but that it knows which of the things it knows are true enough to act on. Ninety-two thousand exposures, sixteen triggers. The sixteen are where the work is.

11. Investigation Metadata

Cristian Lișneanu · shuffle-on.com · Threat Intelligence