Malicious SHA-256 file hash 73850adc8e93… (OffSeq Mirage)

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 5 time(s) in attacker activity between 2026-11-02 and 2026-11-02. Associated with CVE-2026-109618. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in LT. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

• mirage.offseq.com (opens in a new tab)

• several Festo Didactic products · Two Critical PHP VulnerabilitiesExploitedVulnerability2026-11-02
• WAGO: Multiple Devices affected by PHP2ShellExploitedVulnerability2026-11-02
• SUSE · security update for phpExploitedVulnerability2026-10-26
• Welotec: PHP2Shell VulnerabilitiesExploitedVulnerability2026-10-29
• METTLER TOLEDO: PHP2ShellExploitedVulnerability2026-10-28