Malicious SHA-256 file hash a863e21577e5… (OffSeq Mirage)

A malicious file identified by the SHA-256 hash a863e21577e54cd763729803a621804da4b5030afa35bcf879ea3b3413488a66 was observed by OffSeq Mirage honeypot sensors during attacker activity on 2026-10-26. This file is associated with CVE-2026-109618 and linked to the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool used during the attack. The activity was traced back to attacker infrastructure in PS. Organizations are advised to match this hash against files in their environments and threat intelligence feeds.

• mirage.offseq.com (opens in a new tab)

• Red Hat Security Advisory: php security updateExploitedVulnerability2026-10-23
• Red Hat Security Advisory: php security updateExploitedVulnerability2026-10-23
• SUSE · security update for phpExploitedVulnerability2026-10-23
• Red Hat Security Advisory: php:8.2 security updateExploitedVulnerability2026-10-23
• Red Hat Security Advisory: php:7.4 security updateExploitedVulnerability2026-10-23