A Korean-Speaking Crew Is Building a PHP2Shell Hit List
CYFIRMA says Korean-speaking operators are quietly scanning 216 unpatched PHP hosts at governments, banks and logistics firms, with a moderate-confidence Lazarus link.
The Roundup
Security news from around the web with our take: what happened, what it means for you, and what defenders should do. We link every original story.
2 stories match your filters.
Lazarus Turns a Korean Banking Plug-In Into a Spy’s Front Door
Kaspersky says Lazarus abused South Korea's mandatory INISAFE CrossWeb EX security plug-in to break into at least three firms, using fake résumé sites, GitHub-based C2 and a post-quantum key exchange.