A Korean-Speaking Crew Is Building a PHP2Shell Hit List
CYFIRMA says Korean-speaking operators are quietly scanning 216 unpatched PHP hosts at governments, banks and logistics firms, with a moderate-confidence Lazarus link.
A Korean-speaking crew may be lining up PHP2Shell for a targeted run at government, banking and logistics servers. In an advisory dated Oct. 23 and updated Oct. 24, CYFIRMA says operators talking in a closed I2P channel have moved from reconnaissance to slow, quiet scanning of 216 PHP hosts they believe are still unpatched. CYFIRMA suspects a North Korean state link, possibly within the Lazarus ecosystem, but it’s careful to call that an assessment, not a finding. The bugs themselves are already under broad attack, as we covered in Amazon’s pre-disclosure report.
For defenders
CVEs: CVE-2026-109618 and CVE-2026-109619, both unauthenticated RCE, CVSS v4.0 9.2. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; 8.1 and older get no official fix (our first write-up has the details). CYFIRMA rates Apache mod_php the most exposed setup.
Attribution, carefully: CYFIRMA has HIGH confidence the campaign activity is real, based on the channel chatter and target lists. It puts the Lazarus link at only MODERATE, resting on language and past tradecraft rather than shared infrastructure or malware, and lists a Korean-speaking criminal group with no state direction as an alternative. The operators’ handles are aliases. CYFIRMA has confirmed no mass compromise by this actor and names no victims.
Targets: government and banks first, then manufacturing, shipping and aviation, across the US, Asia-Pacific, the Gulf and the EU, including PHP embedded in appliances and cPanel or Plesk. Described tradecraft: T1595.002 (Active Scanning: Vulnerability Scanning), T1190 (Exploit Public-Facing Application), T1505.003 (Server Software Component: Web Shell) and reading wp-config.php and .env files, T1552.001 (Unsecured Credentials: Credentials In Files).
Hunt: CYFIRMA says to look back to Oct. 17 with wide time windows, since the scanning is deliberately low-volume, and to grab evidence before patching, because restarting workers wipes CVE-2026-109619 state. Watch for PHP processes spawning sh, curl or wget, or running anything from /tmp or /dev/shm. The advisory’s three IP lists are worth pulling; investigate hits before blocking.
User-Agent: php2shell-scan/109618
User-Agent: php2shell-verify/1.0
User-Agent: Mozilla/5.0 (php2shell-poc)
Multipart field: PHP_SESSION_UPLOAD_PROGRESS
Boundary prefix: p2shellhxxp://92.118.112[.]100/nfs (Mirai-style loader)What it means for you
If your website runs on PHP (most WordPress sites do), it needs the October PHP update. This advisory suggests someone is building a short list of high-value servers that missed it. If a hosting company manages your site, the update is their job, but it’s worth asking them to confirm it’s done.
Do this now
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then fully restart PHP workers. A reload isn’t enough.
- Can’t patch within hours? Take internet-facing mod_php servers off the internet or put them behind a WAF.
- Copy web, WAF and proxy logs back to Oct. 17 before you change anything, then search for the markers above.
- Ask your host or appliance vendor in writing whether the PHP inside their product is patched.
CVE at a glance
- CVSS
- 9.2 Critical (v4.0)
- EPSS
- 100% chance of exploitation in the next 30 days (higher than 99.9% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Oct 26, 2026
- Public exploit
- Yes, reported in Exploit-DB, a Nuclei template and 708 GitHub repositories
- CVSS
- 9.2 Critical (v4.0)
- EPSS
- 100% chance of exploitation in the next 30 days (higher than 99.9% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Oct 26, 2026
- Public exploit
- Yes, reported in 24 GitHub repositories
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.