Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
Excerpt
Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's privileges. CVE CVSSv4 Description CVE-2026-109618 9.2 (Critical) RCE via OOM…
Read the original report →Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-109618 | High | Score 84/100 | First seen |
| CVE | CVE-2026-109619 | High | Score 84/100 | First seen |
| CVE | CVE-2026-115560 | High | Score 69/100 | First seen |
IOC Relationship Graph
Building graph…