Cyfirma links PHP flaw scans to a North Korean campaign

Cyfirma links a PHP2Shell campaign to a North Korea‑linked operation, reporting that scans of 216 vulnerable PHP hosts were identified after PHP released emergency patches on 21 October for CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. The flaws affect all PHP versions handling web requests and reside in the PHP engine itself, allowing remote code execution via unauthenticated HTTP requests.

Cloudflare researchers observed tens of thousands of exploitation attempts within 45 minutes of disclosure, rising to hundreds of thousands in two hours and millions by 22 October. Cyfirma says the actors are targeting 216 hosts that remain unpatched or only partially mitigated, and that 21 scan nodes were named as part of the operation; operators communicate via a private I2P channel monitored by Cyfirma.

Cyfirma attributes the activity to a Lazarus‑affiliated North Korean group, though it notes that a Korean‑speaking criminal crew without state backing could fit the same facts. The campaign prioritises government and banking sectors, with logistics, ports, airports, manufacturing and financial trading platforms also in scope across the US, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia and the EU.

The operators allegedly use a local AI model to rank public exploits and test results in a lab, rather than developing new exploits. They reportedly check all targets using 21 scan nodes and plan to expand to all 216 hosts, selecting the most promising exploits for adaptation. Technical disclosures indicate that Apache mod_php with default settings and prefork is the worst case for 109618, while PHP-FPM is implicated for 109619 via the upload-progress path.