Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
Excerpt
On October 20, 2026, details of two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 , leaked online ahead of their coordinated disclosure and before any patch existed. The PHP security team responded with advance notice of an emergency security release, scheduled for October 21, 2026 at 14:00 UTC, and rated both flaws critical with a CVSS v4.0 score of 9.2. Researchers at watchTowr confirmed the vulnerabilities are real and said they…
Read the original report →Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | 31c0ea7d7ff1d1fccb6492e52dab544011628065 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-109618 | High | Score 83/100 | First seen |
| CVE | CVE-2026-109619 | High | Score 83/100 | First seen |
IOC Relationship Graph
Building graph…