Science & Tech · Cybersecurity · 2 hrs ago
Researchers warn of planned attacks exploiting critical PHP flaws
A Singapore cybersecurity firm says it found plans for attacks exploiting two PHP flaws discussed by a Korean-speaking group on a private network.
PHP is widely used to run websites, and the flaws could let attackers run commands on servers without logging in.
Government agencies and financial institutions were listed as priority targets, alongside industries including manufacturing, shipping and online trade.
The firm said the group may be connected to North Korea’s Lazarus Group, but rated that assessment only moderately reliable.
Researchers have not found direct evidence linking the group to Lazarus, such as shared malware or attack infrastructure.
PHP issued a security update on October 21, and South Korea’s government and internet security agency issued a warning and guidance the next day.
Organizations using PHP should apply the fixes and follow security guidance; the alleged North Korean link needs further verification.
CYFIRMA says it detected preparations for attacks exploiting critical PHP2Shell vulnerabilities, but no actual breach has been confirmed.
The activity involved Korean-speaking users discussing reconnaissance and attack plans on the I2P network, according to the cybersecurity firm.
CYFIRMA assessed that the group may be linked to North Korea’s Lazarus Group, but rated that connection only moderate confidence.
Government and financial institutions were named as priority targets, alongside organizations in several other sectors and regions.
PHP developers released an emergency security update on October 21, and South Korean authorities issued a caution alert the following day.
- Who
- CYFIRMA detected activity by Korean-speaking users. The group may be linked to North Korea’s Lazarus Group, but that connection is not confirmed.
- What
- The users reportedly planned and tested attacks exploiting PHP2Shell vulnerabilities. No actual breach has been confirmed.
- When
- The activity was reported on October 24, 2026. CYFIRMA said it had observed activity and additional indicators in the preceding days.
- Where
- The plans were discussed on the I2P network, with targets described as worldwide.
- Why
- The sources say the attackers planned to exploit PHP vulnerabilities to gain remote access to web servers. Their broader motive is not stated.
CYFIRMA
Security expert quoted by Yonhap
Attribution
CYFIRMA
CYFIRMA said the group may be part of or connected to the Lazarus Group ecosystem, with moderate confidence.
Security expert quoted by Yonhap
The expert said there was not enough evidence to directly connect the group to Lazarus.
Evidence
CYFIRMA
CYFIRMA cited Korean-language planning and the selection of government and financial targets.
Security expert quoted by Yonhap
The expert said direct overlaps in malware or attack infrastructure had not been shown.
Response
CYFIRMA
CYFIRMA urged patching and monitoring for threats.
Security expert quoted by Yonhap
The expert said the vulnerability should be addressed while the attribution is treated as requiring further verification.
The PHP development team released an emergency security update for the vulnerabilities.
South Korea’s Ministry of Science and ICT and KISA issued a caution alert and advised companies on security measures.
CYFIRMA said it identified global reconnaissance and attack planning through its private-source data collection.
CYFIRMA identified 17 additional source IP addresses in suspicious activity, but said this alone did not directly link them to the North Korea-related channel.
- Vulnerabilities
- PHP2Shell: CVE-2026-109618 and CVE-2026-109619
- Severity
- CVSS 9.2 out of 10, classified as critical
- Campaign name
- June 2026 Minjun
- Attribution confidence
- Moderate, according to CYFIRMA
- Additional IP addresses
- 17 identified on October 23
- PHP website share
- About 69.3% of websites use PHP, according to Donga Ilbo
What people are saying
They are collecting publicly available proof-of-concept exploit code, ranking it with their own AI model and testing it in a controlled environment before actual use.
Lazarus-related hacking groups seek both financial gain and intelligence gathering, so if they gain access to a server, they may hand access to other hackers, steal cryptocurrency, prepare ransomware attacks or steal account information.
Direct evidence linking them to the Lazarus Group, such as overlaps in malware or attack infrastructure, has not been confirmed.
It is appropriate to prioritize monitoring and responding to the vulnerability and signs of attack preparation, while classifying North Korean involvement as information requiring further verification.