{"type":"bundle","id":"bundle--4abc04e1-7eb8-41d1-8718-90f5cb283706","x_observatory_generated_at":"2026-10-23T19:10:00Z","x_observatory_schema_version":"1.0","objects":[{"type":"vulnerability","spec_version":"2.1","id":"vulnerability--224676ff-e2b3-4f8c-8627-6eb7e26a9157","created":"2026-10-23T19:10:00.000Z","modified":"2026-10-23T19:10:00.000Z","name":"CVE-2026-109618","external_references":[{"source_name":"cve","external_id":"CVE-2026-109618"}],"x_observatory_headline_tier":"poc-validated","x_observatory_entry_url":"https://exploitobservatory.com/v1/entry/CVE-2026-109618"},{"type":"indicator","spec_version":"2.1","id":"indicator--30bb90c6-42f8-403c-8d63-2d0143480a82","created":"2026-10-17T00:00:00.000Z","modified":"2026-10-23T19:10:00.000Z","name":"CVE-2026-109618 http-header: PHP_SESSION_UPLOAD_PROGRESS","pattern_type":"stix","pattern":"[network-traffic:extensions.'http-request-ext'.request_header.'PHP_SESSION_UPLOAD_PROGRESS' MATCHES '.*']","valid_from":"2026-10-17T00:00:00.000Z","indicator_types":["malicious-activity"],"kill_chain_phases":[{"kill_chain_name":"lockheed-martin-cyber-kill-chain","phase_name":"delivery"}],"confidence":85,"object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"x_observatory_ioc_id":"IOC-1b6a994b574e","x_observatory_source_sightings":["SIGHT-CVE-2026-109618-0001","SIGHT-CVE-2026-109618-0003","SIGHT-CVE-2026-109618-0004","SIGHT-CVE-2026-109618-0005","SIGHT-CVE-2026-109618-0008","SIGHT-CVE-2026-109618-0010","SIGHT-CVE-2026-109618-0013","SIGHT-CVE-2026-109618-0017"],"x_observatory_independent_reporters":7},{"type":"relationship","spec_version":"2.1","id":"relationship--f948ed34-9994-46b9-88dc-427cfd313126","created":"2026-10-23T19:10:00.000Z","modified":"2026-10-23T19:10:00.000Z","relationship_type":"indicates","source_ref":"indicator--30bb90c6-42f8-403c-8d63-2d0143480a82","target_ref":"vulnerability--224676ff-e2b3-4f8c-8627-6eb7e26a9157"},{"type":"indicator","spec_version":"2.1","id":"indicator--ea6f46f8-ae14-4377-8a4f-94f4ab19c73b","created":"2026-10-17T00:00:00.000Z","modified":"2026-10-23T19:10:00.000Z","name":"CVE-2026-109618 http-header: PHP_SESSION_UPLOAD_PROGRESS field in multipart/form-data POST","pattern_type":"stix","pattern":"[network-traffic:extensions.'http-request-ext'.request_header.'PHP_SESSION_UPLOAD_PROGRESS field in multipart/form-data POST' MATCHES '.*']","valid_from":"2026-10-17T00:00:00.000Z","indicator_types":["malicious-activity"],"kill_chain_phases":[{"kill_chain_name":"lockheed-martin-cyber-kill-chain","phase_name":"delivery"}],"confidence":85,"object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"x_observatory_ioc_id":"IOC-1a2b3c4d5e6f","x_observatory_source_sightings":["SIGHT-CVE-2026-109618-0001","SIGHT-CVE-2026-109618-0004","SIGHT-CVE-2026-109618-0007"],"x_observatory_independent_reporters":3},{"type":"relationship","spec_version":"2.1","id":"relationship--896d8eed-4f0f-49ab-82c6-bb8a7e484117","created":"2026-10-23T19:10:00.000Z","modified":"2026-10-23T19:10:00.000Z","relationship_type":"indicates","source_ref":"indicator--ea6f46f8-ae14-4377-8a4f-94f4ab19c73b","target_ref":"vulnerability--224676ff-e2b3-4f8c-8627-6eb7e26a9157"},{"type":"indicator","spec_version":"2.1","id":"indicator--73384891-4698-40ca-8429-2a8e933364cf","created":"2026-10-21T09:05:00.000Z","modified":"2026-10-23T19:10:00.000Z","name":"CVE-2026-109618 payload-sha256: 023c7955caf9305f1070e2bc3f29bbb49f91562b220be45b8f5a087dbf4dee32","pattern_type":"stix","pattern":"[file:hashes.'SHA-256' = '023c7955caf9305f1070e2bc3f29bbb49f91562b220be45b8f5a087dbf4dee32']","valid_from":"2026-10-21T09:05:00.000Z","indicator_types":["malicious-activity"],"kill_chain_phases":[{"kill_chain_name":"lockheed-martin-cyber-kill-chain","phase_name":"exploitation"}],"confidence":30,"object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"x_observatory_ioc_id":"IOC-01af65f58d92","x_observatory_source_sightings":["SIGHT-CVE-2026-109618-0008"],"x_observatory_independent_reporters":1},{"type":"relationship","spec_version":"2.1","id":"relationship--96ea1c41-5d41-48c8-8790-221257f0d4be","created":"2026-10-23T19:10:00.000Z","modified":"2026-10-23T19:10:00.000Z","relationship_type":"indicates","source_ref":"indicator--73384891-4698-40ca-8429-2a8e933364cf","target_ref":"vulnerability--224676ff-e2b3-4f8c-8627-6eb7e26a9157"},{"type":"indicator","spec_version":"2.1","id":"indicator--e873d42c-5db8-4981-8978-0d95914ab571","created":"2026-10-20T16:00:00.000Z","modified":"2026-10-23T19:10:00.000Z","name":"CVE-2026-109618 payload-sha256: 730b23ceecfd06e238ac622f1f49b757a7e03580e3fcd12da5b0a6390f77f4c9","pattern_type":"stix","pattern":"[file:hashes.'SHA-256' = '730b23ceecfd06e238ac622f1f49b757a7e03580e3fcd12da5b0a6390f77f4c9']","valid_from":"2026-10-20T16:00:00.000Z","indicator_types":["malicious-activity"],"kill_chain_phases":[{"kill_chain_name":"lockheed-martin-cyber-kill-chain","phase_name":"exploitation"}],"confidence":30,"object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"x_observatory_ioc_id":"IOC-6e53c3db2000","x_observatory_source_sightings":["SIGHT-CVE-2026-109618-0005"],"x_observatory_independent_reporters":1},{"type":"relationship","spec_version":"2.1","id":"relationship--e85210b6-0a19-43be-829e-0ef9bda16ba1","created":"2026-10-23T19:10:00.000Z","modified":"2026-10-23T19:10:00.000Z","relationship_type":"indicates","source_ref":"indicator--e873d42c-5db8-4981-8978-0d95914ab571","target_ref":"vulnerability--224676ff-e2b3-4f8c-8627-6eb7e26a9157"},{"type":"indicator","spec_version":"2.1","id":"indicator--43dded3d-da9d-4cb5-8be1-447fa4682221","created":"2026-10-20T14:00:00.000Z","modified":"2026-10-23T19:10:00.000Z","name":"CVE-2026-109618 process-cmdline: sh -c","pattern_type":"stix","pattern":"[process:command_line MATCHES 'sh -c']","valid_from":"2026-10-20T14:00:00.000Z","indicator_types":["malicious-activity"],"kill_chain_phases":[{"kill_chain_name":"lockheed-martin-cyber-kill-chain","phase_name":"exploitation"}],"confidence":30,"object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"x_observatory_ioc_id":"IOC-8a170e705f22","x_observatory_source_sightings":["SIGHT-CVE-2026-109618-0004"],"x_observatory_independent_reporters":1},{"type":"relationship","spec_version":"2.1","id":"relationship--db42659d-5509-4ccb-8a14-2b34396c9c72","created":"2026-10-23T19:10:00.000Z","modified":"2026-10-23T19:10:00.000Z","relationship_type":"indicates","source_ref":"indicator--43dded3d-da9d-4cb5-8be1-447fa4682221","target_ref":"vulnerability--224676ff-e2b3-4f8c-8627-6eb7e26a9157"},{"type":"indicator","spec_version":"2.1","id":"indicator--80ebe1a3-4170-40ed-8adc-a1382519e35d","created":"2026-10-17T00:00:00.000Z","modified":"2026-10-23T19:10:00.000Z","name":"CVE-2026-109618 url-path: /","pattern_type":"stix","pattern":"[url:value MATCHES '/']","valid_from":"2026-10-17T00:00:00.000Z","indicator_types":["malicious-activity"],"kill_chain_phases":[{"kill_chain_name":"lockheed-martin-cyber-kill-chain","phase_name":"exploitation"}],"confidence":60,"object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"x_observatory_ioc_id":"IOC-297775ba4eed","x_observatory_source_sightings":["SIGHT-CVE-2026-109618-0001","SIGHT-CVE-2026-109618-0002"],"x_observatory_independent_reporters":2},{"type":"relationship","spec_version":"2.1","id":"relationship--429bc7f4-0786-4aa2-8675-acdcc6ab25b4","created":"2026-10-23T19:10:00.000Z","modified":"2026-10-23T19:10:00.000Z","relationship_type":"indicates","source_ref":"indicator--80ebe1a3-4170-40ed-8adc-a1382519e35d","target_ref":"vulnerability--224676ff-e2b3-4f8c-8627-6eb7e26a9157"},{"type":"indicator","spec_version":"2.1","id":"indicator--456dccad-f67f-4803-8b3c-40b0ac4fdd5b","created":"2026-10-18T04:10:00.000Z","modified":"2026-10-23T19:10:00.000Z","name":"CVE-2026-109618 url-path: /index.php","pattern_type":"stix","pattern":"[url:value MATCHES '/index.php']","valid_from":"2026-10-18T04:10:00.000Z","indicator_types":["malicious-activity"],"kill_chain_phases":[{"kill_chain_name":"lockheed-martin-cyber-kill-chain","phase_name":"exploitation"}],"confidence":60,"object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"x_observatory_ioc_id":"IOC-6d480a1e1de9","x_observatory_source_sightings":["SIGHT-CVE-2026-109618-0002","SIGHT-CVE-2026-109618-0003"],"x_observatory_independent_reporters":2},{"type":"relationship","spec_version":"2.1","id":"relationship--1d8906e4-4d0b-4357-82da-4d967fec8ae4","created":"2026-10-23T19:10:00.000Z","modified":"2026-10-23T19:10:00.000Z","relationship_type":"indicates","source_ref":"indicator--456dccad-f67f-4803-8b3c-40b0ac4fdd5b","target_ref":"vulnerability--224676ff-e2b3-4f8c-8627-6eb7e26a9157"},{"type":"indicator","spec_version":"2.1","id":"indicator--520f0ccb-99d1-4e42-87ff-6a5e8cbac553","created":"2026-10-22T09:30:00.000Z","modified":"2026-10-23T19:10:00.000Z","name":"CVE-2026-109618 url-path: /php-cgi.exe","pattern_type":"stix","pattern":"[url:value MATCHES '/php-cgi.exe']","valid_from":"2026-10-22T09:30:00.000Z","indicator_types":["malicious-activity"],"kill_chain_phases":[{"kill_chain_name":"lockheed-martin-cyber-kill-chain","phase_name":"exploitation"}],"confidence":30,"object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"x_observatory_ioc_id":"IOC-e2a75e4dbe74","x_observatory_source_sightings":["SIGHT-CVE-2026-109618-0012"],"x_observatory_independent_reporters":1},{"type":"relationship","spec_version":"2.1","id":"relationship--07f2145f-3711-4c53-87d0-55d1a5589637","created":"2026-10-23T19:10:00.000Z","modified":"2026-10-23T19:10:00.000Z","relationship_type":"indicates","source_ref":"indicator--520f0ccb-99d1-4e42-87ff-6a5e8cbac553","target_ref":"vulnerability--224676ff-e2b3-4f8c-8627-6eb7e26a9157"},{"type":"indicator","spec_version":"2.1","id":"indicator--5ea83d9c-3faf-4d77-8692-9a884c38a707","created":"2026-10-19T13:20:00.000Z","modified":"2026-10-23T19:10:00.000Z","name":"CVE-2026-109618 url-path: /wp-login.php","pattern_type":"stix","pattern":"[url:value MATCHES '/wp-login.php']","valid_from":"2026-10-19T13:20:00.000Z","indicator_types":["malicious-activity"],"kill_chain_phases":[{"kill_chain_name":"lockheed-martin-cyber-kill-chain","phase_name":"exploitation"}],"confidence":60,"object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"x_observatory_ioc_id":"IOC-fe9627d7859d","x_observatory_source_sightings":["SIGHT-CVE-2026-109618-0003","SIGHT-CVE-2026-109618-0004","SIGHT-CVE-2026-109618-0008"],"x_observatory_independent_reporters":3},{"type":"relationship","spec_version":"2.1","id":"relationship--06f90887-70a5-461d-8491-6432b7a4aade","created":"2026-10-23T19:10:00.000Z","modified":"2026-10-23T19:10:00.000Z","relationship_type":"indicates","source_ref":"indicator--5ea83d9c-3faf-4d77-8692-9a884c38a707","target_ref":"vulnerability--224676ff-e2b3-4f8c-8627-6eb7e26a9157"},{"type":"indicator","spec_version":"2.1","id":"indicator--c89e81e5-092c-4ac4-8ceb-695966573d49","created":"2026-10-20T14:00:00.000Z","modified":"2026-10-23T19:10:00.000Z","name":"CVE-2026-109618 url-path: multipart upload filename containing serialized PHP (O:, a:, s: prefixes)","pattern_type":"stix","pattern":"[url:value MATCHES 'multipart upload filename containing serialized PHP (O:, a:, s: prefixes)']","valid_from":"2026-10-20T14:00:00.000Z","indicator_types":["malicious-activity"],"kill_chain_phases":[{"kill_chain_name":"lockheed-martin-cyber-kill-chain","phase_name":"exploitation"}],"confidence":85,"object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"x_observatory_ioc_id":"IOC-2b3c4d5e6f70","x_observatory_source_sightings":["SIGHT-CVE-2026-109618-0004","SIGHT-CVE-2026-109618-0007"],"x_observatory_independent_reporters":2},{"type":"relationship","spec_version":"2.1","id":"relationship--e1554ed8-f311-4336-8a2d-e3332f34f16a","created":"2026-10-23T19:10:00.000Z","modified":"2026-10-23T19:10:00.000Z","relationship_type":"indicates","source_ref":"indicator--c89e81e5-092c-4ac4-8ceb-695966573d49","target_ref":"vulnerability--224676ff-e2b3-4f8c-8627-6eb7e26a9157"},{"type":"indicator","spec_version":"2.1","id":"indicator--9021f0f5-bb69-4c62-83ef-abf96ca265f6","created":"2026-10-18T04:10:00.000Z","modified":"2026-10-23T19:10:00.000Z","name":"CVE-2026-109618 user-agent: curl/8.5.0","pattern_type":"stix","pattern":"[network-traffic:extensions.'http-request-ext'.request_header.'User-Agent' MATCHES 'curl/8.5.0']","valid_from":"2026-10-18T04:10:00.000Z","indicator_types":["malicious-activity"],"kill_chain_phases":[{"kill_chain_name":"lockheed-martin-cyber-kill-chain","phase_name":"delivery"}],"confidence":30,"object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"x_observatory_ioc_id":"IOC-6b5fcd394385","x_observatory_source_sightings":["SIGHT-CVE-2026-109618-0002"],"x_observatory_independent_reporters":1},{"type":"relationship","spec_version":"2.1","id":"relationship--6f10aee7-912b-4d88-8759-94e49a3e2210","created":"2026-10-23T19:10:00.000Z","modified":"2026-10-23T19:10:00.000Z","relationship_type":"indicates","source_ref":"indicator--9021f0f5-bb69-4c62-83ef-abf96ca265f6","target_ref":"vulnerability--224676ff-e2b3-4f8c-8627-6eb7e26a9157"}]}