Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure

A Korean-speaking threat actor linked with moderate confidence to North Korea's Lazarus Group is conducting a global campaign exploiting two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. The campaign targets government agencies, financial institutions, manufacturing, logistics, aviation, and trading platforms across multiple countries including the US, Japan, and EU. Exploitation attempts have been observed since 17 October 2026, involving web shell deployment and session poisoning. The vulnerabilities affect all internet-facing PHP installations below versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, with Apache mod_php being at highest risk.

• PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619ExploitedVulnerability2026-10-21
• Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)ExploitedCampaign2026-10-22
• CVE-2026-109618: PHP · Use After FreeCriticalVulnerability2026-10-21
• Critical security issue affecting PHPExploitedVulnerability2026-10-21
• PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCEExploitedExploit2026-10-22