Exposed Server at 137.175.93.126 Logs 25,195 Confirmed WordPress and Joomla Webshell Installs in WP-SHELLSTORM Operation

The exposed Python web server ran for 22 days after June 11 2026, revealing automated scanners targeting 1.4 million domains pulled from FOFA. Primary success came from CVE-2026-3844 in the Breeze plugin, which hit 45,000 targets and yielded over 17,000 shells when the non-default Gravatars setting was enabled. SOCRadar counted 5,700 live shells while Ctrl-Alt-Intel's deduplication reached 25,195 validated compromises, showing the gap between scan lists and actual access. Evidence includes four-layer obfuscated down.php derived from BestShell, SNOWLIGHT droppers installing VShell masquerading as [kworker/0:2], and typed operator commands confirming resale of access. Joomla JCE targets exceeded 560,000 yet produced only 77 shells, underscoring low conversion rates typical of mass exploitation. This matches a documented pattern of long-lived web-server compromise where initial plugin flaws enable persistent brokerage operations that persist because remediation focuses on symptoms rather than infrastructure exposure. The same VShell chain appeared in Sysdig's April 2025 reporting on UNC5174 activity, though VShell's open distribution prevents firm state attribution from tooling alone. Follow-up coverage remains thin; the same infrastructure model will likely reappear on new rented IPs within weeks unless hosting providers implement directory indexing blocks and rapid takedown for known malicious patterns.