{
  "schema_version": "1.0",
  "cve": null,
  "generated_at": "2026-10-25T23:17:14.028Z",
  "tlp": "clear",
  "count": 14,
  "indicators": [
    {
      "id": "IOC-5e6f708192a3",
      "cve": "CVE-2026-109618",
      "type": "cidr",
      "value": "[41 aggregated /24 ranges, see ips.txt]",
      "sightings": [
        "SIGHT-CVE-2026-109618-0001",
        "SIGHT-CVE-2026-109618-0007",
        "SIGHT-CVE-2026-109618-0012"
      ],
      "independent_reporters": 3,
      "first_seen": "2026-10-17T00:00:00Z",
      "last_seen": "2026-10-23T00:00:00Z",
      "confidence": "low",
      "tlp": "clear",
      "kill_chain": "scan",
      "expires": "2026-11-22T00:00:00Z",
      "fingerprints": [],
      "notes": "Honeypot source ranges. Expire automatically. Do not block without review; CDN egress ranges have appeared."
    },
    {
      "id": "IOC-1b6a994b574e",
      "cve": "CVE-2026-109618",
      "type": "http-header",
      "value": "PHP_SESSION_UPLOAD_PROGRESS",
      "sightings": [
        "SIGHT-CVE-2026-109618-0001",
        "SIGHT-CVE-2026-109618-0003",
        "SIGHT-CVE-2026-109618-0004",
        "SIGHT-CVE-2026-109618-0005",
        "SIGHT-CVE-2026-109618-0008",
        "SIGHT-CVE-2026-109618-0010",
        "SIGHT-CVE-2026-109618-0013",
        "SIGHT-CVE-2026-109618-0017"
      ],
      "independent_reporters": 7,
      "first_seen": "2026-10-17T00:00:00Z",
      "last_seen": "2026-10-23T10:00:00Z",
      "confidence": "high",
      "tlp": "clear",
      "kill_chain": "delivery",
      "expires": null,
      "fingerprints": [
        "fp-6a0a73b77e19",
        "fp-c8a325e4462b"
      ]
    },
    {
      "id": "IOC-1a2b3c4d5e6f",
      "cve": "CVE-2026-109618",
      "type": "http-header",
      "value": "PHP_SESSION_UPLOAD_PROGRESS field in multipart/form-data POST",
      "sightings": [
        "SIGHT-CVE-2026-109618-0001",
        "SIGHT-CVE-2026-109618-0004",
        "SIGHT-CVE-2026-109618-0007"
      ],
      "independent_reporters": 3,
      "first_seen": "2026-10-17T00:00:00Z",
      "last_seen": "2026-10-23T11:00:00Z",
      "confidence": "high",
      "tlp": "clear",
      "kill_chain": "delivery",
      "expires": null,
      "fingerprints": [
        "fp-3a1c9e7d02b4",
        "fp-8f02d4b1e6a9"
      ],
      "notes": "Present in every observed attempt. Legitimate use exists but is rare on sites without upload progress bars."
    },
    {
      "id": "IOC-01af65f58d92",
      "cve": "CVE-2026-109618",
      "type": "payload-sha256",
      "value": "023c7955caf9305f1070e2bc3f29bbb49f91562b220be45b8f5a087dbf4dee32",
      "sightings": [
        "SIGHT-CVE-2026-109618-0008"
      ],
      "independent_reporters": 1,
      "first_seen": "2026-10-21T09:05:00Z",
      "last_seen": "2026-10-21T09:05:00Z",
      "confidence": "low",
      "tlp": "clear",
      "kill_chain": "exploit",
      "expires": null,
      "fingerprints": [
        "fp-6a0a73b77e19"
      ]
    },
    {
      "id": "IOC-6e53c3db2000",
      "cve": "CVE-2026-109618",
      "type": "payload-sha256",
      "value": "730b23ceecfd06e238ac622f1f49b757a7e03580e3fcd12da5b0a6390f77f4c9",
      "sightings": [
        "SIGHT-CVE-2026-109618-0005"
      ],
      "independent_reporters": 1,
      "first_seen": "2026-10-20T16:00:00Z",
      "last_seen": "2026-10-20T16:00:00Z",
      "confidence": "low",
      "tlp": "clear",
      "kill_chain": "exploit",
      "expires": null,
      "fingerprints": [
        "fp-6a0a73b77e19"
      ]
    },
    {
      "id": "IOC-3c4d5e6f7081",
      "cve": "CVE-2026-109618",
      "type": "payload-sha256",
      "value": "a91f0000000000000000000000000000000000000000000000000000PLACEHOLDER",
      "sightings": [
        "SIGHT-CVE-2026-109618-0001",
        "SIGHT-CVE-2026-109618-0007"
      ],
      "independent_reporters": 2,
      "first_seen": "2026-10-17T00:00:00Z",
      "last_seen": "2026-10-21T07:30:00Z",
      "confidence": "medium",
      "tlp": "clear",
      "kill_chain": "exploit",
      "expires": null,
      "fingerprints": [],
      "notes": "Hash of a captured honeypot payload body. Body itself is not stored."
    },
    {
      "id": "IOC-8a170e705f22",
      "cve": "CVE-2026-109618",
      "type": "process-cmdline",
      "value": "sh -c",
      "sightings": [
        "SIGHT-CVE-2026-109618-0004"
      ],
      "independent_reporters": 1,
      "first_seen": "2026-10-20T14:00:00Z",
      "last_seen": "2026-10-20T14:00:00Z",
      "confidence": "low",
      "tlp": "clear",
      "kill_chain": "exploit",
      "expires": null,
      "fingerprints": [
        "fp-6a0a73b77e19"
      ]
    },
    {
      "id": "IOC-4d5e6f708192",
      "cve": "CVE-2026-109618",
      "type": "sigma-ref",
      "value": "https://github.com/splunk/security_content/releases/tag/v6.9.1",
      "sightings": [
        "SIGHT-CVE-2026-109618-0011"
      ],
      "independent_reporters": 1,
      "first_seen": "2026-10-21T00:00:00Z",
      "last_seen": "2026-10-22T00:00:00Z",
      "confidence": "high",
      "tlp": "clear",
      "kill_chain": "exploit",
      "expires": null,
      "fingerprints": [
        "fp-3a1c9e7d02b4",
        "fp-8f02d4b1e6a9"
      ],
      "notes": "ESCU 6.9.1 PHP2Shell analytic story: serialized PHP in upload filename, memory exhaustion correlation, web server spawning shell."
    },
    {
      "id": "IOC-297775ba4eed",
      "cve": "CVE-2026-109618",
      "type": "url-path",
      "value": "/",
      "sightings": [
        "SIGHT-CVE-2026-109618-0001",
        "SIGHT-CVE-2026-109618-0002"
      ],
      "independent_reporters": 2,
      "first_seen": "2026-10-17T00:00:00Z",
      "last_seen": "2026-10-18T04:10:00Z",
      "confidence": "medium",
      "tlp": "clear",
      "kill_chain": "exploit",
      "expires": null,
      "fingerprints": []
    },
    {
      "id": "IOC-6d480a1e1de9",
      "cve": "CVE-2026-109618",
      "type": "url-path",
      "value": "/index.php",
      "sightings": [
        "SIGHT-CVE-2026-109618-0002",
        "SIGHT-CVE-2026-109618-0003"
      ],
      "independent_reporters": 2,
      "first_seen": "2026-10-18T04:10:00Z",
      "last_seen": "2026-10-19T13:20:00Z",
      "confidence": "medium",
      "tlp": "clear",
      "kill_chain": "exploit",
      "expires": null,
      "fingerprints": [
        "fp-6a0a73b77e19"
      ]
    },
    {
      "id": "IOC-e2a75e4dbe74",
      "cve": "CVE-2026-109618",
      "type": "url-path",
      "value": "/php-cgi.exe",
      "sightings": [
        "SIGHT-CVE-2026-109618-0012"
      ],
      "independent_reporters": 1,
      "first_seen": "2026-10-22T09:30:00Z",
      "last_seen": "2026-10-22T09:30:00Z",
      "confidence": "low",
      "tlp": "clear",
      "kill_chain": "exploit",
      "expires": null,
      "fingerprints": [
        "fp-673e158ea062"
      ]
    },
    {
      "id": "IOC-fe9627d7859d",
      "cve": "CVE-2026-109618",
      "type": "url-path",
      "value": "/wp-login.php",
      "sightings": [
        "SIGHT-CVE-2026-109618-0003",
        "SIGHT-CVE-2026-109618-0004",
        "SIGHT-CVE-2026-109618-0008"
      ],
      "independent_reporters": 3,
      "first_seen": "2026-10-19T13:20:00Z",
      "last_seen": "2026-10-21T09:05:00Z",
      "confidence": "medium",
      "tlp": "clear",
      "kill_chain": "exploit",
      "expires": null,
      "fingerprints": [
        "fp-6a0a73b77e19"
      ]
    },
    {
      "id": "IOC-2b3c4d5e6f70",
      "cve": "CVE-2026-109618",
      "type": "url-path",
      "value": "multipart upload filename containing serialized PHP (O:, a:, s: prefixes)",
      "sightings": [
        "SIGHT-CVE-2026-109618-0004",
        "SIGHT-CVE-2026-109618-0007"
      ],
      "independent_reporters": 2,
      "first_seen": "2026-10-20T14:00:00Z",
      "last_seen": "2026-10-23T11:00:00Z",
      "confidence": "high",
      "tlp": "clear",
      "kill_chain": "exploit",
      "expires": null,
      "fingerprints": [
        "fp-3a1c9e7d02b4"
      ],
      "notes": "Pattern, not a literal path. WAF rule matches the filename parameter."
    },
    {
      "id": "IOC-6b5fcd394385",
      "cve": "CVE-2026-109618",
      "type": "user-agent",
      "value": "curl/8.5.0",
      "sightings": [
        "SIGHT-CVE-2026-109618-0002"
      ],
      "independent_reporters": 1,
      "first_seen": "2026-10-18T04:10:00Z",
      "last_seen": "2026-10-18T04:10:00Z",
      "confidence": "low",
      "tlp": "clear",
      "kill_chain": "delivery",
      "expires": "2026-11-17T04:10:00Z",
      "fingerprints": []
    }
  ]
}