As promised, we've updated our #PHP2Shell story with detailed observable indicators. These are based on a broad review of working proofs-of-concept, and should yield high-fidelity hunts and detections. They've also been added to our MISP feed.
https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914
#ThreatIntel
IFIN - The Independent Federated Intelligence Network
npub1qm…nh363
2026-10-22 19:53:22 UTC
Author Public Key
npub1qm4tytdmranfklywc562p7gprs702mzkc4usqv6t8ja3d340evpslnh363Seen on
wss://relay.momostr.pinkPublished at
2026-10-22 19:53:22 UTCEvent JSON
{
"id": "f05724856f7267b149828911fe7690690b3c1466f0d9e41ab27363e298e682b7",
"pubkey": "06eab22dbb1f669b7c8ec534a0f9011c3cf56c56c57900334b3cbb16c6afcb03",
"created_at": 1792698802,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@ifin/117486308706972948",
"web"
],
[
"t",
"php2shell"
],
[
"t",
"threatintel"
],
[
"proxy",
"https://infosec.exchange/ap/users/115741367687413652/statuses/117486308706972948",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/ap/users/115741367687413652/statuses/117486308706972948",
"pink.momostr"
],
[
"-"
]
],
"content": "As promised, we've updated our #PHP2Shell story with detailed observable indicators. These are based on a broad review of working proofs-of-concept, and should yield high-fidelity hunts and detections. They've also been added to our MISP feed.\n\nhttps://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914\n\n#ThreatIntel",
"sig": "8e119c44c259cc150989bf393a6abbc8f81dcabbfec6c86b73c78318ebee4a8a61524ec4859873303eecf67c932cbcac0e4fb608852a8b4a2ef776cc2771c0e0"
}