Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution
Threat Actors
Malware Families
Excerpt
PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution | SECURITY.COM Skip to main content Threat Intelligence Feature Stories Expert Perspectives Tech Insights Threat Updates Podcasts Events Broadcom Home PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution Patch now: CVE-2026-109618 and CVE-2026-109619 let unauthenticated attackers run code on web servers running PHP, and details were public before fixes shipped. Threat…
Read the original report →Diamond Model
Adversary(2)
Infrastructure
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-109618 | High | Score 84/100 | First seen |
| CVE | CVE-2026-109619 | High | Score 84/100 | First seen |
IOC Relationship Graph
Building graph…