Kumar Ritesh

PHP2Shell update: the DPRK-nexus campaign has moved from planning to active scanning. CYFIRMA has issued Version 3 of its Early Warning advisory on PHP2Shell (CVE-2026-109618 / CVE-2026-109619, CVSS v4.0 9.2 — unauthenticated RCE in the PHP runtime itself). What’s new since our 22–23 October reporting: 🔴 The operators report a filtered target set of 216 internet-facing hosts that still advertise unpatched PHP — across the US, Japan, South Korea, Thailand, Indonesia, Taiwan, Australia, India, Singapore, UAE, Saudi Arabia and the EU, with government, financial services, logistics, aviation, manufacturing and online transaction platforms prioritised. 🔴 Active weakness checks are being run from a separate set of 21 compromised nodes, deliberately low-volume and paced to stay under rate-based alerting. Roughly a third of the target set had already been touched at the time of collection. 🔴 CYFIRMA observed the same 21 addresses performing web-shell tooling and upload-progress session-poisoning attempts in the hours before this update. They are now published as blocking indicators alongside the 17 source IPs from Version 2. What to do now: ✅ Patch to PHP 8.5.12+ / 8.4.27+ / 8.3.36+ / 8.2.35+ and restart every worker — a reload leaves the stale state in place. ✅ Hosts still bannering an older PHP version are exactly what the operators kept on their list. Isolate what you can’t patch within hours; Apache mod_php first. ✅ Hunt back to 17 October across extended time windows — this scanning is designed not to trip volume alerts. No launch date has been stated. The next adversary milestone is their shortlist of highest-confidence hosts. The channel remains under continuous monitoring, and the advisory will be re-issued on any launch statement or confirmed exploitation. #PHP2Shell #ThreatIntelligence #EarlyWarning #Lazarus #DPRK #CVE2026109618 #CVE2026109619 #CYFIRMA #DecodingThreats #CYFIRMA #CYFIRMAresearch #ETLM #ExternalThreatLandscapeManagement cyfirma.com/research/cyfirma…

#PHP2Shell is about to go from opportunistic to targeted. #CYFIRMA has surfaced a #Korean-speaking threat actor, assessed with moderate confidence to be linked to the #Lazarus ecosystem, coordinating sector- and country-prioritised exploitation of the two critical #PHP runtime flaws known as PHP2Shell (#CVE2026109618 / #CVE2026109619, CVSS v4.0 9.2, unauthenticated #RCE). What makes this different from the scanning everyone is already seeing: ▪️ Deliberate targeting: government and financial institutions first, then logistics, ports, airports, and manufacturing ▪️ Priority geographies: US, Japan, Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia and the EU ▪️ Disciplined tradecraft: public PoCs ranked with a local AI model, lab-validated before use, no noisy scanning ▪️ 15 pieces of staging infrastructure already shared; first filtered target list due by 25 October The flaw sits in the PHP runtime itself, not in any CMS or framework, so updating WordPress, Drupal, Magento, or Laravel does not fix it. One multipart POST can reach code execution before any application code runs. What to do now: ✅ Patch to PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 and restart every worker (a reload is not enough) ✅ Isolate anything you cannot patch within hours; Apache mod_php first ✅ Hunt back to 17 October 2026 ✅ Deploy the IOCs, Sigma and YARA content in the report Full advisory (TLP: CLEAR) with 33 IOCs, detection rules, and interim controls. #CyberSecurity #ThreatIntelligence #DPRK #CYFIRMA #CYFIRMA #ExternalThreatLandscapeManagement #ETLM cyfirma.com/research/cyfirma…