Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
PHP2Shell: Critical PHP RCE Flaws CVE-2026-109618 & CVE-2026-109619
Excerpt
Blog October 22, 2026 Vulnerability PHP2Shell: Critical PHP RCE Flaws CVE-2026-109618 & CVE-2026-109619 On October 21, 2026 the PHP project shipped emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619. Researchers call the pair PHP2Shell, because together they let someone who can only send ordinary web requests end up running code on the server, with no login. The bugs are in the PHP engine, not in any one application. WordPress, Drupal, Magento and…
Read the original report →Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-109618 | High | Score 84/100 | First seen |
| CVE | CVE-2026-109619 | High | Score 84/100 | First seen |
IOC Relationship Graph
Building graph…