IOC feeds
Every unexpired indicator across all entries, in the formats a WAF, TIP or script can pull. Query params mirror the feed: ?confidence= &type= &since=.
IP and domain indicators come only from honeypot and WAF sightings and expire 30 days after last sighting. Request paths and headers never expire.
Single-source indicators are published but flagged. Nothing above TLP:GREEN is ever accepted.
Combined active feed · 14 indicators
curl -s 'https://exploitobservatory.com/v1/iocs/active.json?confidence=medium&type=url-path'Active indicators across all entries
| Type | Value | CVE | Confidence | Sources | First seen | Last seen | Expires |
|---|---|---|---|---|---|---|---|
| cidr | [41 aggregated /24 ranges, see ips.txt] | CVE-2026-109618 | low | 3 | 2026-10-17 | 2026-10-23 | 2026-11-22 |
| http-header | PHP_SESSION_UPLOAD_PROGRESS | CVE-2026-109618 | high | 7 | 2026-10-17 | 2026-10-23 | never |
| http-header | PHP_SESSION_UPLOAD_PROGRESS field in multipart/form-data POST | CVE-2026-109618 | high | 3 | 2026-10-17 | 2026-10-23 | never |
| payload-sha256 | 023c7955caf9305f1070e2bc3f29bbb49f91562b220be45b8f5a087dbf4dee32 | CVE-2026-109618 | low single-source | 1 | 2026-10-21 | 2026-10-21 | never |
| payload-sha256 | 730b23ceecfd06e238ac622f1f49b757a7e03580e3fcd12da5b0a6390f77f4c9 | CVE-2026-109618 | low single-source | 1 | 2026-10-20 | 2026-10-20 | never |
| payload-sha256 | a91f0000000000000000000000000000000000000000000000000000PLACEHOLDER | CVE-2026-109618 | medium | 2 | 2026-10-17 | 2026-10-21 | never |
| process-cmdline | sh -c | CVE-2026-109618 | low single-source | 1 | 2026-10-20 | 2026-10-20 | never |
| sigma-ref | https://github.com/splunk/security_content/releases/tag/v6.9.1 | CVE-2026-109618 | high single-source | 1 | 2026-10-21 | 2026-10-22 | never |
| url-path | / | CVE-2026-109618 | medium | 2 | 2026-10-17 | 2026-10-18 | never |
| url-path | /index.php | CVE-2026-109618 | medium | 2 | 2026-10-18 | 2026-10-19 | never |
| url-path | /php-cgi.exe | CVE-2026-109618 | low single-source | 1 | 2026-10-22 | 2026-10-22 | never |
| url-path | /wp-login.php | CVE-2026-109618 | medium | 3 | 2026-10-19 | 2026-10-21 | never |
| url-path | multipart upload filename containing serialized PHP (O:, a:, s: prefixes) | CVE-2026-109618 | high | 2 | 2026-10-20 | 2026-10-23 | never |
| user-agent | curl/8.5.0 | CVE-2026-109618 | low single-source | 1 | 2026-10-18 | 2026-10-18 | 2026-11-17 |
Per-entry exports
- CVE-2026-109618 14 indicators