Suspected North Korean campaign targets 216 vulnerable PHP hosts
Original title: PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts
Cyfirma links a Lazarus-linked group using AI-ranked public exploits to monitor and scan 216 unpatched PHP hosts via private I2P channel.
Cyfirma reports a suspected North Korean campaign using PHP2Shell scans of 216 vulnerable hosts. PHP released emergency patches for CVE-2026-109618 and CVE-2026-109619 on October 21. The group checks systems from 21 scan nodes and plans to test public exploits with a local AI model. Targets include government agencies and banks in the US, Japan, South Korea and other countries. Researchers assess high imminence but no confirmed large-scale compromises.
Unconfirmed: No confirmed large-scale compromises; moderate confidence in Lazarus link
- PHP patches fix 109618 and 109619 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35
- Targets: US, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia and EU
- Group uses I2P channel and local AI to rank exploits
- Slow scanning avoids rate-based detection
- Restart patched workers after updates
Impact: unauthenticated remote code execution on PHP web servers
- 1.upgrade to fixed PHP versions
- 2.isolate internet-facing Apache mod_php or PHP-FPM
- 3.capture memory logs before patching
- Vendors
- PHP
- Products
- PHP engine
- Threat actors
- Lazarus family
- Organizations
- Cyfirma
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
5 min read at securityaffairs.com
Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9. 2 on the CVSS scale.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.