Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
PHP2Shell Weaponized After Japanese Real Estate Extortion
Excerpt
SOCRadar Threat Research Unit identified an open directory on 96.126.130.81 that exposed the working files of an operator who ran an extortion campaign against Japanese real estate websites and then turned to PHP2Shell , the pair of unauthenticated PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. The server held more than 3,800 files, including a weaponized copy of the PHP2Shell reproducer package , scripts for web shell deployment and lateral movement, beacon logs,…
Read the original report →Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-109618 | High | Score 84/100 | First seen |
| CVE | CVE-2026-109619 | High | Score 84/100 | First seen |
IOC Relationship Graph
Building graph…