Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Excerpt
Key Findings CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell, are flaws in the PHP interpreter itself. Every application on an affected build inherits the exposure regardless of framework, CMS or plugins. The PHP security team scored both at 9.2 on CVSS v4.0. A remote attacker with no credentials can run code as the web server worker account. PHP2Shell also includes an unauthenticated path that discloses live worker memory without executing any code.…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 95.217.98.37 | High | Score 58/100 | First seen |
| CVE | CVE-2026-109618 | High | Score 83/100 | First seen |
| IP | 37.19.200.5 | High | Score 58/100 | First seen |
| IP | 103.216.220.92 | High | Score 58/100 | First seen |
| CVE | CVE-2026-109619 | High | Score 83/100 | First seen |
| IP | 103.114.163.188 | High | Score 58/100 | First seen |
| IP | 134.209.159.64 | High | Score 58/100 | First seen |
| IP | 31.223.184.166 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…