The internet took a massive hit this week, and I had a front-row seat to the chaos.

On 21 October 2026, two critical bugs in the PHP runtime went public, and exploit attempts hit the millions within a day. My side project, MatrixMonitor, had been logging the internet's worst attackers every night through all of it.

So I did what any curious engineer would do. I exported three days of data (20–22 October, UTC), set it against the news timeline, and wrote a 27-page threat report.

This post covers three things: how MatrixMonitor works, what actually happened during the PHP2Shell week, and what 295 attacker IPs told me. The most useful finding turned out to be about my own system, not about the attackers.

If you want to look while you read, the globe is live at matrix-monitor.aniruddhagawali.dev .

What MatrixMonitor is

MatrixMonitor is a full-stack threat-intelligence dashboard that draws the internet's most-reported attackers, and the countries they hit, on a 3D globe.…