CYFIRMA Reports Suspected DPRK-Linked Campaign Preparing PHP2Shell Attacks

Oct 23, 2026 · Original article ↗

Summary

CYFIRMA reports that Korean-speaking operators are preparing targeted PHP2Shell attacks against internet-facing PHP systems. Its Lazarus link assessment remains moderate-confidence, with no confirmed mass successful exploitation attributed to the actors.

Key points

CYFIRMA says closed I2P-channel monitoring on 22 October revealed the June 2026 Minjun campaign preparing country- and sector-prioritised target lists, with government and financial institutions first.
The operators reportedly planned to adapt public exploits, use a local AI model to rank repositories and validate approaches in a lab while avoiding noisy scanning. No launch date or specific victims were identified.
PHP2Shell comprises CVE-2026-109618 and CVE-2026-109619, which the advisory describes as unauthenticated RCE flaws involving out-of-memory corruption and stale request state inherited by subsequent requests on the same PHP worker.
CYFIRMA assesses a Lazarus-ecosystem link with moderate confidence based on language, targeting and tradecraft, but reports no definitive malware or infrastructure overlap; an unaffiliated Korean-speaking criminal group remains an alternative explanation.
CYFIRMA identified 17 suspected source IPs attempting web-shell tooling and upload-progress session poisoning on 23 October, but explicitly states that these observations do not establish a link to the suspected DPRK campaign.
The advisory recommends upgrading to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or verified vendor backports, and restarting all PHP workers. Disabling upload progress alone does not mitigate CVE-2026-109618.
Recommended hunting starts on 17 October and correlates malformed multipart requests, PHP worker crashes, unexpected shell processes and new web-root files. CYFIRMA did not independently execute or test exploit code.

Article Details

Attack Vectors: Reported exploitation of internet-facing PHP through crafted multipart/form-data requests: CVE-2026-109618 involves out-of-memory corruption, while CVE-2026-109619 involves stale request state, including session upload progress.
CYFIRMA intercepted planning to collect public PHP banners and version strings, prioritize targets by country and sector, and adapt public exploit repositories after AI-assisted ranking and manual laboratory validation. A launch date and successful compromises attributable to these operators were not confirmed.
Separately observed activity included PHP web shell tooling and upload-progress session poisoning attempts; CYFIRMA did not establish that these source addresses belonged to the suspected DPRK-linked operators.
Defensive Notes: Upgrade to PHP 8.5.12+, 8.4.27+, 8.3.36+, or 8.2.35+, or a verified vendor backport. Restart all PHP workers and verify the live web-serving binary rather than only the CLI version.
Isolate internet-facing installations that cannot be patched promptly, prioritizing Apache mod_php. Updating applications or frameworks does not repair these runtime vulnerabilities.
For CVE-2026-109618, the report recommends temporary administrative memory_limit=-1, constrained multipart requests and post_max_size, reduced input nesting, and container memory boundaries. These controls do not replace patching.
For CVE-2026-109619, temporarily disable session upload progress and, on PHP 8.5, fatal_error_backtraces; consider pm.max_requests=1 where feasible. Disabling upload progress does not mitigate CVE-2026-109618.
Hunt from 2026-10-17 for unusual multipart POSTs, correlated worker crashes, oversized PHPSESSID cookies, web-worker child shells or download utilities, new web-root files, and suspicious outbound connections.
If compromise is suspected, preserve memory and logs before restarting workers, isolate the host, rebuild from a trusted patched image, and rotate secrets accessible to the PHP worker.
Treat shared or anonymizing infrastructure sightings as investigative leads rather than proof of compromise. The supplied YARA content was reportedly tested synthetically, not against real application code; exclude detection repositories and intelligence feeds from scans.

Indicators of compromise

Type	Indicator	Context
IPV4	`102[.]207[.]250[.]188`	Suspected source of PHP web shell tooling and upload-progress session poisoning attempts observed on 2026-10-23; not independently linked to the operator channel.
IPV4	`103[.]216[.]220[.]92`	Amazon MadPot reportedly observed a pre-disclosure PHP2Shell exploitation attempt from this address on 2026-10-17.
IPV4	`103[.]77[.]210[.]80`	Shared in the intercepted operator channel for staging, target-list hosting, or launch; exact role unresolved.
IPV4	`109[.]56[.]219[.]150`	Shared in the intercepted operator channel for staging, target-list hosting, or launch; exact role unresolved.
IPV4	`109[.]71[.]252[.]97`	Appendix identifies this address as attempting exploitation of both PHP2Shell vulnerabilities, according to a second sensor network.
IPV4	`128[.]90[.]176[.]13`	Shared in the intercepted operator channel for staging, target-list hosting, or launch; exact role unresolved.
IPV4	`134[.]209[.]252[.]157`	Suspected source of PHP web shell tooling and upload-progress session poisoning attempts observed on 2026-10-23; not independently linked to the operator channel.
IPV4	`138[.]199[.]34[.]201`	Shared in the intercepted operator channel for staging, target-list hosting, or launch; exact role unresolved.
IPV4	`138[.]68[.]161[.]170`	Suspected source of PHP web shell tooling and upload-progress session poisoning attempts observed on 2026-10-23; not independently linked to the operator channel.
IPV4	`145[.]255[.]150[.]25`	Shared in the intercepted operator channel for staging, target-list hosting, or launch; exact role unresolved.
IPV4	`146[.]190[.]107[.]103`	Suspected source of PHP web shell tooling and upload-progress session poisoning attempts observed on 2026-10-23; not independently linked to the operator channel.
IPV4	`146[.]70[.]114[.]180`	Shared in the intercepted operator channel for staging, target-list hosting, or launch; exact role unresolved.
IPV4	`146[.]70[.]114[.]182`	Shared in the intercepted operator channel for staging, target-list hosting, or launch; exact role unresolved.
IPV4	`147[.]175[.]149[.]67`	Shared in the intercepted operator channel for staging, target-list hosting, or launch; exact role unresolved.
IPV4	`147[.]78[.]168[.]57`	Shared in the intercepted operator channel for staging, target-list hosting, or launch; exact role unresolved.
IPV4	`149[.]102[.]232[.]44`	Shared in the intercepted operator channel for staging, target-list hosting, or launch; exact role unresolved.
IPV4	`149[.]102[.]232[.]93`	Shared in the intercepted operator channel for staging, target-list hosting, or launch; exact role unresolved.
IPV4	`158[.]173[.]242[.]133`	Shared in the intercepted operator channel for staging, target-list hosting, or launch; exact role unresolved.
IPV4	`158[.]173[.]75[.]178`	Shared in the intercepted operator channel for staging, target-list hosting, or launch; exact role unresolved.
IPV4	`185[.]203[.]18[.]54`	Shared in the intercepted operator channel for staging, target-list hosting, or launch; exact role unresolved.
IPV4	`185[.]207[.]232[.]121`	Suspected source of PHP web shell tooling and upload-progress session poisoning attempts observed on 2026-10-23; not independently linked to the operator channel.
IPV4	`185[.]235[.]212[.]105`	Shared in the intercepted operator channel for staging, target-list hosting, or launch; exact role unresolved.
IPV4	`45[.]198[.]224[.]169`	Appendix identifies this address as scanning with the php2shell-scan user-agent, according to a second sensor network.
IPV4	`78[.]47[.]85[.]99`	Suspected source of PHP web shell tooling and upload-progress session poisoning attempts observed on 2026-10-23; not independently linked to the operator channel.
IPV4	`85[.]11[.]167[.]243`	Appendix identifies this address as scanning with the php2shell-scan user-agent, according to a second sensor network.
IPV4	`94[.]154[.]43[.]185`	Suspected source of PHP web shell tooling and upload-progress session poisoning attempts observed on 2026-10-23; not independently linked to the operator channel.
SHA256	`0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486`	Reported hash of the 'nfs' second-stage ELF x86-64 payload, 179632 bytes; attributed to one honeypot vendor and not independently corroborated.
SHA256	`43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a`	Exact hash of a captured PHP2Shell scanner or OOM-tool HTTP request body, not a malware file; byte-for-byte body matching only.
SHA256	`7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6`	Exact hash of a captured PHP2Shell scanner or OOM-tool HTTP request body, not a malware file; byte-for-byte body matching only.
URL	`hxxp[:]//92[.]118[.]112[.]100/nfs`	Reported staging URL for a Mirai-style loader fetched to /tmp and executed with argument 'php' during PHP2Shell exploitation.

MITRE ATT&CK

T1059.004 · Unix ShellReported blind-RCE validation used the shell command 'uname -a; id; echo JACKALPOC'.T1105 · Ingress Tool TransferCorroborating exploitation telemetry describes fetching the loader from hxxp://92.118.112[.]100/nfs to /tmp before execution.T1190 · Exploit Public-Facing ApplicationThe report describes unauthenticated exploitation attempts against public-facing PHP using crafted multipart requests to trigger out-of-memory corruption or stale request state.T1505.003 · Web ShellCYFIRMA reported PHP web shell tooling activity from suspected source addresses; it did not establish attribution to the intercepted operators.T1588.005 · ExploitsOperators discussed obtaining and adapting public PHP2Shell exploit repositories, ranking them with local AI and manually validating them in a controlled laboratory.T1593 · Search Open Websites/DomainsIntercepted tasking called for collecting public PHP banners and version strings and reviewing public technical material rather than conducting broad active scans.

CVE

CVE-2026-109618Korean-speaking operators plan sector-targeted exploitation of CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2, unauthenticated RCE in PHP core)CVE-2026-109619Korean-speaking operators plan sector-targeted exploitation of CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2, unauthenticated RCE in PHP core)

Threat Actors

APT38Listed by the article as an alias within the Lazarus Group ecosystem; the suspected operator link is moderate-confidence and not established through infrastructure or malware overlap.Diamond SleetListed by the article as an alias within the Lazarus Group ecosystem; the suspected operator link is moderate-confidence and not established through infrastructure or malware overlap.Hidden CobraListed by the article as an alias within the Lazarus Group ecosystem; the suspected operator link is moderate-confidence and not established through infrastructure or malware overlap.Lazarus GroupCYFIRMA assesses a link between the intercepted operators and this ecosystem with moderate confidence, based on language and behavior rather than confirmed infrastructure or malware overlap. The article lists APT38, Hidden Cobra, ZINC, and Diamond Sleet as aliases.ZINCListed by the article as an alias within the Lazarus Group ecosystem; the suspected operator link is moderate-confidence and not established through infrastructure or malware overlap.

Products

Apache mod_phpApache mod_php is the highest-risk configuration.FrankenPHPAll internet-facing PHP runtimes: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed (LSAPI), and embedded PHP in appliances and hosting control panels (cPanel, Plesk).LiteSpeedLiteSpeed (LSAPI)PHPCYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure PHP-CGIAll internet-facing PHP runtimes: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed (LSAPI), and embedded PHP in appliances and hosting control panels (cPanel, Plesk).PHP-FPMValidated against both mod_php and PHP-FPM.

Countries

Industries