Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
29 IOCs
Patched, Not Over: PHP2Shell Exploits Keep Spreading Underground
Threat Actors
Excerpt
Blog October 27, 2026 Dark Web Patched, Not Over: PHP2Shell Exploits Keep Spreading Underground PHP fixed the two PHP2Shell vulnerabilities on 21 October 2026, yet alleged exploit code kept circulating on underground forums and Telegram through 23 October. The patch has not ended attacker interest, so defenders need to confirm the fix is actually running and hunt for signs of exploitation. Key Findings Two critical PHP flaws: CVE-2026-109618 and CVE-2026-109619 both carry a…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →29 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 117.55.202.115 | High | Score 58/100 | First seen |
| IP | 45.136.71.89 | High | Score 58/100 | First seen |
| IP | 15.235.206.16 | High | Score 58/100 | First seen |
| IP | 158.69.113.75 | High | Score 63/100 | First seen |
| IP | 45.198.224.169 | High | Score 63/100 | First seen |
| URL | http://92.118.112.100/nfs | High | Score 58/100 | First seen |
| CVE | CVE-2026-109618 | High | Score 84/100 | First seen |
| IP | 176.65.132.128 | High | Score 58/100 | First seen |
| IP | 94.154.43.149 | High | Score 63/100 | First seen |
| IP | 185.161.210.29 | High | Score 58/100 | First seen |
| IP | 185.196.220.132 | High | Score 78/100 | First seen |
| IP | 85.11.167.243 | High | Score 63/100 | First seen |
| CVE | CVE-2026-109619 | High | Score 84/100 | First seen |
| Domain | thunder.godofthunder.st | High | Score 58/100 | First seen |
| IP | 181.215.186.252 | High | Score 58/100 | First seen |
| IP | 87.121.84.174 | High | Score 58/100 | First seen |
| Domain | godofthunder.st | High | Score 58/100 | First seen |
| Domain | hackattackkaboom.botlesscucks.st | High | Score 86/100 | First seen |
| IP | 206.188.197.105 | High | Score 63/100 | First seen |
| IP | 77.237.246.73 | High | Score 58/100 | First seen |
| IP | 193.47.62.24 | High | Score 58/100 | First seen |
| URL | http://92.118.112.100/nfs-setup | High | Score 58/100 | First seen |
| CVE | CVE-2026-115560 | High | Score 69/100 | First seen |
| IP | 45.134.225.16 | High | Score 58/100 | First seen |
| URL | http://92.118.112.100/s | High | Score 58/100 | First seen |
| IP | 143.246.223.124 | High | Score 63/100 | First seen |
| IP | 5.191.140.240 | High | Score 63/100 | First seen |
| Domain | hik.gettingheadfromduckysmom.st | High | Score 86/100 | First seen |
| IP | 134.199.154.64 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…