Verticals Targeted: Government, Financial, Manufacturing, Aviation, Airports
Regions Targeted: United States, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia, European Union
Related Threat Actors: Lazarus Group
Executive Summary
A suspected North Korean state-linked threat operation has reportedly progressed from reconnaissance to active scanning of internet-facing PHP servers exposed to CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Operators communicating through a closed I2P channel reportedly identified 216 potentially vulnerable hosts and began conducting low-volume scans using 21 compromised systems, with government agencies and financial institutions among their priority targets. The activity raises concerns that attackers could exploit these critical vulnerabilities to establish persistent access, steal credentials, and conduct financial or intelligence-gathering operations against targeted organizations.
Key Takeaways
- Suspected DPRK-linked operators assembled a target list of 216 potentially vulnerable PHP servers, with approximately one-third reportedly scanned by October 24.
- The operators allegedly use 21 compromised scanning nodes, rotating infrastructure and deliberately limiting request volumes to reduce detection.
- Government agencies, financial institutions, manufacturing, logistics, aviation, and online transaction platforms are among the sectors identified in the reported targeting instructions.
- Although CYFIRMA suspects a connection to the Lazarus Group ecosystem, no definitive tooling or infrastructure overlap has been established, and successful compromises attributable to this operation remain unconfirmed.
Background
A Korean-speaking threat operation suspected of having ties to North Korea's state-sponsored cyber ecosystem is reportedly preparing to exploit two critical PHP vulnerabilities against government and commercial infrastructure worldwide. In an October 24 update, CYFIRMA disclosed intelligence suggesting that the operators had completed an initial list of 216 potentially vulnerable servers and begun actively testing those systems for exploitable weaknesses.
The development follows the October 21 disclosure of CVE-2026-109618 and CVE-2026-109619, two memory-safety vulnerabilities in the PHP engine that can enable unauthenticated remote code execution under affected configurations. Both vulnerabilities carry CVSS v4.0 scores of 9.2. As previously reported by PolySwarm, their location within the PHP runtime creates exposure beyond individual applications, potentially affecting websites, content management systems, and services that rely on vulnerable PHP installations.
CYFIRMA reports that the operators coordinated through a closed I2P channel and were first observed discussing the campaign on October 22. Their instructions reportedly prioritize government agencies and financial institutions, followed by manufacturing, logistics, shipping, aviation, and online transaction platforms. Geographic priorities include the United States, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia, and the European Union.
The reported activity represents a progression from broad vulnerability reconnaissance toward a more selective targeting process. Rather than indiscriminately scanning internet-facing systems, the operators allegedly filtered out hosts advertising patched PHP versions or demonstrating stronger defensive filtering. The remaining systems were organized by sector and geography, with subsequent scan results intended to identify the most promising exploitation candidates.
CYFIRMA associates the operation with the broader Lazarus Group ecosystem based on Korean language communications, targeting preferences and historical operational patterns. However, the available reporting does not establish a definitive connection to a specific North Korean intrusion cluster. The observed activity should therefore be treated as a suspected state-linked campaign rather than confirmed Lazarus exploitation.
Technical Analysis
Vulnerability Background
PHP2Shell encompasses two distinct vulnerabilities affecting memory management within the PHP runtime. CVE-2026-109618 involves memory corruption during out-of-memory handling. When PHP exhausts an allocated memory limit during certain operations, incomplete initialization can leave internal structures in an unsafe state. Subsequent cleanup operations may then access or process corrupted data.
CVE-2026-109619 involves a stale internal state that can retain references to previously freed memory. Under certain conditions, a later request handled by the same PHP worker can interact with that stale state, creating a use-after-free condition. PHP's session upload-progress functionality is one of the identified paths associated with this vulnerability. Both vulnerabilities can support remote code execution, although successful exploitation depends on runtime configuration, worker behavior, and the reliability of the exploit technique. Other demonstrated outcomes include process crashes and disclosure of sensitive memory contents.
The PHP project released fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Earlier end-of-life branches do not receive official upstream fixes, although some vendors provided independently maintained security backports. Organizations should verify the version used by their active web-serving PHP processes rather than relying exclusively on the installed command-line binary.
A third vulnerability, CVE-2026-115560, was subsequently disclosed on October 23. This issue also involves PHP's session upload progress functionality and may permit remote code execution under a specific combination of configuration and application conditions. It is distinct from the original PHP2Shell vulnerabilities and was not addressed by the October 21 patches. Disabling session upload progress provides a mitigation for affected configurations, but organizations should consult applicable vendor guidance for complete remediation. There is currently no established connection between CVE-2026-115560 and the suspected DPRK-linked activity described by CYFIRMA.
Scanning Infrastructure
CYFIRMA reports that the suspected operators are using 21 compromised nodes to conduct active PHP weakness checks against their filtered target list. These systems are separate from 15 previously identified staging addresses and 17 additional source addresses associated with suspicious PHP activity. CYFIRMA did not conclusively associate the earlier 17 addresses with the monitored I2P channel.
The reported scanning strategy emphasizes operational restraint. Operators allegedly rotate between compromised systems, limit request volumes and discontinue use of addresses encountering filtering or rate-limiting. Scan results are recorded alongside the original target inventory to support further prioritization.
According to CYFIRMA, the 21 addresses named in the intercepted communications were also observed conducting PHP web-shell-related activity and upload-progress session-poisoning attempts during an eight-hour observation period preceding the October 24 advisory. These observations strengthen the reported association between the scanning infrastructure and the operators' communications. However, the presence of web-shell tooling or session-poisoning attempts does not independently establish successful exploitation of either PHP2Shell vulnerability. The use of compromised systems as scanning infrastructure also complicates attribution and defensive response. Source addresses may belong to unrelated organizations whose systems have already been compromised, making historical traffic analysis and behavioral detection important alongside indicator-based blocking.
Exploitation and Detection
CYFIRMA identifies crafted multipart/form-data requests as a potential exploitation mechanism, particularly in deployments using Apache mod_php. Session upload progress functionality is relevant to CVE-2026-109619, while CVE-2026-109618 involves a separate out-of-memory corruption path.
The operators reportedly intend to evaluate publicly available exploit approaches against the most promising systems identified during reconnaissance. CYFIRMA also assesses that AI-assisted analysis of public proof-of-concept material may accelerate exploit selection and adaptation. Successful exploitation could allow an attacker to execute commands within the permissions of the affected PHP worker. From that position, an intruder could attempt to deploy web shells, extract application configuration files, obtain database credentials or API keys, and establish additional persistence.
Detection opportunities include unusual multipart requests, unexpected PHP session behavior, repeated memory-exhaustion errors, worker crashes, and web-server processes spawning command interpreters. In some exploitation scenarios, HTTP 500 responses occurring near PHP memory errors or Apache worker failures may provide additional investigative leads. These patterns are not exclusive to PHP2Shell and should be correlated with process, network, and application telemetry.
Defenders should also investigate newly created PHP files in web-accessible directories, unexpected outbound connections from PHP workers, and access to sensitive configuration files. Because the reported scanning activity is deliberately low-volume, detection strategies relying exclusively on high request counts may overlook targeted probing. Independent researchers have documented PHP2Shell exploitation attempts outside the CYFIRMA-described operation. However, these observations should not be interpreted as confirmation that the suspected DPRK-linked operators have successfully compromised their identified targets.
Potential Impact
If the suspected operators successfully exploit vulnerable PHP infrastructure, initial access could provide opportunities for credential theft, data collection, and persistent access to exposed systems. Compromised web servers may also serve as staging points for subsequent attacks against internal networks or connected services.
For government agencies and financial institutions, these footholds could support espionage, financial theft, or access to sensitive operational systems. Organizations in logistics, aviation, and manufacturing may face additional exposure if vulnerable applications connect to enterprise management platforms, supply chain services, or other business-critical infrastructure.
These outcomes remain potential consequences rather than confirmed actions by the operators described in CYFIRMA's report. As of the October 24 update, the advisory did not identify named victims or confirm mass compromise attributable to the suspected campaign.
Who is Lazarus Group?
Lazarus Group is a North Korean state-sponsored cyber threat actor designation associated with espionage, financial theft, and disruptive cyber operations. The name is commonly used to describe a broader ecosystem of overlapping intrusion clusters linked to North Korea's intelligence apparatus, particularly the Reconnaissance General Bureau (RGB). Related activity is tracked under several designations, including Hidden Cobra, APT38, Diamond Sleet and other cluster-specific names, although these labels do not always represent identical sets of operations.
The group's activities have included attacks against government institutions, financial organizations, cryptocurrency platforms, defense contractors, and technology companies. Financially motivated operations associated with the broader Lazarus ecosystem have targeted banking infrastructure and cryptocurrency assets, while other campaigns have focused on intelligence collection, supply chain compromise, and destructive attacks.
Lazarus-associated operators have also demonstrated experience exploiting internet-facing infrastructure and using compromised websites or servers to support malware delivery, C2 communications, and persistent access. Web shells, stolen credentials, and legitimate administrative tools have featured in operations attributed to North Korean threat clusters.
Several related clusters illustrate the range of activity associated with the broader ecosystem. APT38 and BlueNoroff are commonly linked to financial theft, particularly attacks against banks and cryptocurrency organizations. Andariel has been associated with espionage, exploitation of vulnerable infrastructure, and ransomware-related activity, while Kimsuky is primarily known for intelligence collection and credential theft. These groups should not be treated as interchangeable, and their organizational relationships and naming conventions vary across threat intelligence vendors.
This history provides context for CYFIRMA's assessment of the PHP2Shell campaign. The reported prioritization of government and financial targets, combined with interest in exploiting web-facing infrastructure, is consistent with activity previously associated with North Korean operators. However, those similarities are not sufficient to confirm Lazarus involvement, particularly without matching malware, infrastructure, or other distinctive technical evidence.
PolySwarm Analyst Commentary
The reported campaign illustrates how quickly critical vulnerabilities in widely deployed software components can become attractive to targeted threat operations. PHP2Shell presents a particularly consequential attack surface because the vulnerabilities reside within the runtime itself, potentially exposing multiple applications and services regardless of whether their individual codebases contain exploitable flaws.
The operators' reported filtering process also suggests a shift away from indiscriminate exploitation toward identifying systems where defensive gaps may improve the likelihood of successful access. Organizations that have not completed patching, continue operating unsupported PHP versions, or rely heavily on application-layer protections could remain attractive targets even after broader scanning activity subsides.
The suspected North Korean connection introduces additional considerations. Lazarus-associated operations have historically combined financial objectives with espionage and infrastructure compromise, making vulnerable government, financial, and commercial systems potentially valuable for several different purposes. Nevertheless, linguistic indicators and similarities in tradecraft are insufficient to establish definitive attribution, and the possibility of an unrelated Korean-speaking threat operation remains.
The immediate concern is not whether the reported operation ultimately proves to be Lazarus-linked, but whether attackers can convert exposed PHP infrastructure into persistent access before organizations complete remediation. Low-volume scanning, compromised intermediary infrastructure, and the possibility of runtime-level exploitation create detection challenges that conventional request-volume thresholds and application-focused monitoring may not adequately address. Organizations should prioritize verified patch deployment while investigating suspicious activity that may have occurred before the fixes became available.
As attackers move from vulnerability scanning to exploitation, organizations must also prepare for the malicious payloads and post-compromise tooling that may follow. PolySwarm's crowdsourced detection ecosystem provides access to multiple independent detection engines, helping security teams identify emerging malware, analyze suspicious files, and uncover threats that individual security solutions may overlook. By integrating PolySwarm's threat intelligence and file analysis capabilities into existing security workflows, defenders can strengthen their ability to detect malicious activity associated with PHP2Shell exploitation and subsequent intrusion attempts.
IOCs
PolySwarm has a sample associated with this activity.
0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 - nfs second stage (ELF x86-64). Malicious per the source report. Detected by 1 of 11 PolySwarm engines
Don’t have a PolySwarm account? Go here to sign up for a free Community plan or subscribe.
Contact us at hivemind@polyswarm.io | Check out our blog | Subscribe to our reports.
