Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
CVEVerifiedSignal 84/100EPSS 100.0%
CVE-2026-109618
Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
Found in 36 reports: PHP2Shell Weaponized After Japanese Real Estate Extortion; Patched, Not Over: PHP2Shell Exploits Keep Spreading Underground; PHP2Shell Was Exploited Before the Patch · all 36 reports
CVE
Known vulnerability being actively exploited in the wild.
MISP Category
vulnerability
EPSS Score
99.98%
EPSS Percentile
100.0th
Confidence
91%
Signal Score
84 / 100
IDS Rule
No
CVE Intelligence
Exploit Probability99.98%
100.0th percentile of all CVEs
Threat Context
Threat Actors4
Malware Families4
Tags
Feed Intelligence Summary
36 reports91% confidence
PolySwarm
Yesterday
2 IOCs in report
Seqrite
5d ago
2 IOCs in report
Activity Timeline
Threat Activity Heatmap
Related Reports
PHP2Shell Weaponized After Japanese Real Estate Extortion
SOCRadar2 IOC
Patched, Not Over: PHP2Shell Exploits Keep Spreading Underground
ThreatMon29 IOC
PHP2Shell Was Exploited Before the Patch
Sekoia Blog6 IOC
Millions of PHP Servers Face RCE Risk as PHP2Shell Exploitation Attempts Emerge
PolySwarm2 IOC
26th October – Threat Intelligence Report
Check Point Research5 IOC
PHP2Shell: What to know about two critical PHP flaws
ESET Research2 IOC
Node2Shell: Brotli Flaw Hits Python Packages
SOCRadar3 IOC
Inside an Exposed ARTEX Workspace
ThreatMon8 IOC
PHP2Shell: Failed Requests, Memory Corruption and Remote Code Execution
Seqrite2 IOC
PHP2Shell: Critical PHP RCE Flaws CVE-2026-109618 & CVE-2026-109619
ThreatMon2 IOC