Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619)
Excerpt
PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619) | Sansec 112) { this.ssScrolled = true; } else if (window.pageYOffset Scan your store now Scan your store now Product Pricing Resources Research Partners Guides Malware Company Contact Product Pricing Resources Company Contact Research Partners Support Scan your store now! PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619) by Sansec Forensics Team Published in Threat Research − October 21, 2026 PHP fixed two…
Read the original report →Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-109618 | High | Score 83/100 | First seen |
| CVE | CVE-2026-75650 | High | Score 72/100 | First seen |
| CVE | CVE-2026-103849 | Medium | Score 54/100 | First seen |
| CVE | CVE-2026-109619 | High | Score 83/100 | First seen |
IOC Relationship Graph
Building graph…