Korean-speaking operators plan sector-targeted exploitation of CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2, unauthenticated RCE in PHP core)
TLP
TLP:CLEAR
PUBLISHED
23 October 2026
SEVERITY
CRITICAL
CONFIDENCE
HIGH (campaign activity) · MODERATE (Lazarus-ecosystem link)
1 · DOES THIS AFFECT ME?
Any organisation running internet-facing PHP below 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The June 2026 Minjun actors’ tasking prioritises government, banking and finance, manufacturing, logistics and shipping, airports and aviation, online transaction and trading platforms, trading companies and construction across the US, Japan, Thailand, Indonesia, Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia and the EU.
2 · HOW EXPOSED AM I?
One unauthenticated multipart POST can reach code execution before any application code runs. Apache mod_php is the highest-risk configuration. End-of-life PHP (8.1 and older) receives no official upstream fix. Exploitation attempts are confirmed globally, and CYFIRMA has observed 17 further source IPs attempting web shell tooling and upload-progress session poisoning.
3 · WHAT SHOULD I DO NOW?
Patch and restart every PHP worker. Isolate what cannot be patched within hours. Hunt from 17 October 2026. Deploy the IOCs, Sigma and YARA content in Sections 09 and 10, and apply the interim controls in Section 11.
BOTTOM LINE
Treat every internet-facing PHP host below 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 as exposed. Patch immediately and restart all workers; hunt back to 17 October 2026, the earliest known exploitation. Organisations in the sectors and geographies prioritised by the June 2026 Minjun actors should assume they are in scope for deliberate targeting.
On 22 October 2026 (≈11:00 JST / 10:00 SGT), CYFIRMA closed-source collection surfaced a Korean-speaking threat actor coordinating, through a closed I2P channel named █████ ██ ██ (████████████████), global reconnaissance and attack planning against all web-accessible assets carrying the two critical PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). CYFIRMA tracks this activity as the June 2026 Minjun campaign, named after the channel.
CYFIRMA assesses with high confidence that the June 2026 Minjun campaign is being actively staged, and with moderate confidence that the operator is linked to the North Korean Lazarus Group ecosystem (tracked across industry as Lazarus, APT38, Hidden Cobra, ZINC / Diamond Sleet).
The tasking explicitly prioritises national government agencies, banks and financial institutions, manufacturing, logistics, shipping, airports and aviation, online transaction platforms, trading companies and construction firms across the United States, Japan, Thailand, Indonesia, Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia and the European Union. Fifteen pieces of campaign infrastructure were shared in-channel for staging and launch. No launch date has been stated; the actors’ first filtered target list is due by 25 October 2026.
On 23 October 2026, CYFIRMA identified 17 suspected source IP addresses that, within an 8-hour window, were performing PHP web shell tooling and upload-progress session poisoning attempts. This activity is consistent with the exploitation and post-exploitation behaviour anticipated for the campaign. On its own it does not link these addresses to the DPRK-nexus channel, and they are published as additional hunting and blocking indicators.
DeCYFIR visibility. The June 2026 Minjun campaign was identified through CYFIRMA’s closed-source human-intelligence monitoring of underground I2P channels, delivered to customers through DeCYFIR early-warning arrangements.
Methodology.
No exploit code was executed or independently tested in this assessment.
01. A Korean-speaking, suspected DPRK state-nexus actor behind the June 2026 Minjun campaign is in the reconnaissance-to-weaponisation phase against the global PHP estate. CYFIRMA adversary monitoring confirms explicit intent to mass-identify web-accessible assets carrying CVE-2026-109618 and CVE-2026-109619, de-conflict them by country and sector, and adapt public exploit code rather than develop novel primitives.
CONFIDENCE : HIGH (intent and activity), MODERATE (Lazarus link)
02. The most likely initial access vector is exploitation of public-facing PHP services via crafted multipart/form-data requests abusing the session upload-progress path (CVE-2026-109619) or out-of-memory corruption (CVE-2026-109618), with the highest success probability against Apache mod_php in its default prefork configuration. Expected tradecraft aligns with historical Lazarus use of PHP/ASP web shells and compromised web infrastructure for first-stage command-and-control.
CONFIDENCE : MODERATE
03. Timing is opportunistic and tied to exploit readiness rather than an external trigger. The operation fuses financial motivation (initial-access resale, cryptocurrency theft, ransomware precursors, credential theft) with state-nexus espionage objectives. Deliberate sector and geographic prioritisation, with government and financial institutions first, distinguishes this activity from commodity opportunistic scanning and raises the consequence ceiling for targeted organisations.
CONFIDENCE : MODERATE
04. AI-assisted triage is being used by the actor to rank public proof-of-concept repositories and accelerate reconnaissance, compressing the historical gap between disclosure and reliable weaponisation. Patch and mitigation timelines should be measured in hours, not days.
CONFIDENCE : MODERATE
IMMINENCE INDEX
78 / 100. Targets identified (all internet-facing PHP); public exploit tooling circulating; active scanning and early in-the-wild exploitation observed globally; the channel is discussing launch readiness and sector prioritisation. The absence of confirmed mass successful compromise attributable to this specific actor keeps the index below 90.
Discovery snapshot
THREAT ACTOR
DPRK state-nexus operator / small team. Suspected link to Lazarus Group (APT38 / Hidden Cobra / ZINC)
MOTIVATION
Financial gain · Espionage · Disruption. Initial-access brokerage, crypto theft, ransomware; state-nexus espionage; operational disruption
SEVERITY
CRITICAL. Global internet-facing PHP estate
ASSESSED LAUNCH WINDOW
Not yet stated. Reconnaissance ongoing since 22 Oct 2026. First filtered target list expected by 25 Oct 2026. Rapid weaponisation anticipated.
TARGETED SECTORS & GEOGRAPHY
Government, BFSI, manufacturing, logistics/shipping, aviation, e-commerce, trading, construction, hosting/SaaS. Priority geographies: US, JP, TH, ID, KR, AU, TW, IN, SG, UAE, KSA, EU
CONFIDENCE
HIGH (campaign activity). Language, channel activity, targeting pattern. MODERATE (Lazarus link). Historical Lazarus web-shell tradecraft.
The vulnerabilities
PHP2Shell refers to two critical unauthenticated remote code execution vulnerabilities in the PHP runtime itself. Both carry a CVSS v4.0 score of 9.2 (PHP Security Team). Technical details leaked publicly on 20 October 2026, ahead of coordinated disclosure; the PHP project released fixes on 21 October 2026.
Both share one root cause: PHP’s longjmp()-based “bailout” aborts a request mid-operation and leaves internal state half-built or pointing at freed memory. In worker-based deployments, a subsequent request handled by the same worker inherits that stale state.
CVE-2026-109618: RCE via out-of-memory corruption (GHSA-w8hw-w9fx-j79w)
When a request exceeds memory_limit, PHP bails out of the allocator; some execution contexts leave request memory partially initialised, and shutdown cleanup then reads or branches on it.
The attacker controls when memory is exhausted through the multipart parser.
Confirmed full unauthenticated RCE on Apache mod_php with default settings and prefork. Reported by Calif, Wiz, OpenAI and Quarkslab.
CVE-2026-109619: RCE via stale global state (GHSA-6wmf-4rv5-p3rp)
A request that dies at the wrong moment (fatal error, timeout or OOM) leaves request-owned global state pointing at freed memory; a later request on the same worker reads it before initialisation, a use-after-free.
Confirmed consumers: session upload progress (PHP_SESSION_UPLOAD_PROGRESS) and PHP 8.5’s fatal_error_backtraces. Validated against both mod_php and PHP-FPM.
NOTE
Early coverage tied the session upload-progress field to CVE-2026-109618. Per PHP’s advisories it belongs to CVE-2026-109619 only; disabling upload progress does nothing for -109618. The two bugs require different interim controls (Section 11).
Exposure by deployment (SAPI)
| SAPI | CVE-2026-109618 (OOM) | CVE-2026-109619 (STALE STATE) |
| Apache mod_php | Confirmed, full unauthenticated RCE, default limits, prefork | Confirmed |
| PHP-FPM | Susceptible per source analysis; no full exploit shown | Upload-progress path validated |
| FrankenPHP | Likely (similar to mod_php) | Not immune; no default consumer found |
| LiteSpeed (LSAPI) | Likely, unvalidated | Conditional |
| php-cgi | At risk per PHP | At risk per PHP |
Affected and fixed versions
| BRANCH | STATUS | FIX |
| 8.5 | Supported | 8.5.12 |
| 8.4 | Supported | 8.4.27 |
| 8.3 | Security-only | 8.3.36 |
| 8.2 | Security-only | 8.2.35 |
| 8.1, 8.0, 7.4 | End of life | Minimal source backports only; distribution / LTS vendor builds (e.g. cPanel EasyApache 4, CloudLinux alt-php, TuxCare, Plesk; confirm branch coverage with the vendor) |
| 7.3 and older, 5.4+ | End of life | No fix; migrate or isolate |
Exploitability
Triggering the bug is easy; reliable code execution is not. The attacker must land a follow-up request on the same worker and shape heap data into the freed space, otherwise the worker crashes or responds normally. Non-RCE outcomes already demonstrated: worker crash (DoS), arbitrary file read via OPcache, and ~67 KB process-memory disclosure.
VULNCHECK UPDATE (22 OCTOBER 2026, 19:00 ET)
VulnCheck updated its findings on 22 October 2026. It now reports that its exploit achieves RCE on x86-64 with ASLR enabled against PHP 8.4.10 to 8.4.26, that its memory leak works on ARM64 but RCE is not yet functional there, and that at least one public PoC bypassed ASLR on x86-64 for a single version (8.4.26). This supersedes its earlier position that no public PoC bypassed ASLR on x86-64.
Public exploit and PoC evidence
Source-checked as of 22 October 2026. Public repositories should be treated as untrusted; validated research is not equivalent to a validated, production-ready exploit, and several circulating “PoCs” are fake and distribute malware (per JFrog, AhnLab ASEC).
| SOURCE | EVIDENCE TYPE | STATUS / LIMITATION |
| PHP Security Team | Vendor advisory | VENDOR CONFIRMED: reliability varies by allocator, build, extensions, worker layout |
| Wiz / Calif / OpenAI | Original disclosure | RESEARCH REPRODUCED: frontier AI models used to chain the memory-safety flaws |
| Datadog Security Labs | Technical walkthrough | RESEARCH REPRODUCED: focuses on -109618; both reported reproduced |
| VulnCheck | Reproduction (qualified) | See update above; warns many public repos use the wrong mechanism |
| GitHub (9bie, dinosn, lzz0403, ikow, syrex1013) | Author-reported lab | UNVERIFIED / DISPUTED: CVE mapping and portability require scrutiny; some require GDB/local access |
| JFrog / AhnLab ASEC | Fake-PoC warning | Malicious and prank repositories circulating; do not run unaudited PoCs |
Collection source: closed I2P channel
| ATTRIBUTE | DETAIL |
| Platform | I2P (Invisible Internet Project), closed channel |
| Channel | █████ ██ ██ (████████████████) |
| Address | ████████████████████████████████████████████████████.b32.i2p |
| Observed handles | 전███████ (Je██████████), active since March 2026, assessed role: tasking / lead. 최█████ (C███████), active since March 2026, assessed role: collection / exploit triage |
| Activity | Closed sharing of target lists, exploit-hosting infrastructure, tasking and prioritisation; discussion of global reconnaissance against web-accessible PHP assets carrying CVE-2026-109618 and CVE-2026-109619 |
Handles are operator aliases, not confirmed identities.
Evidence and artifacts
On 22 October 2026 the handlers shared campaign infrastructure and tasking related to exploit readiness. No specific customer hosts or victims were listed.
FIGURE 1 I2P forum thread “PHP runtime issue leak (20th) and recon plan”, 전███████ (Je██████████) and 최█████ (C███████), 22 Oct 2026, 11:00 to 11:31 JST.
FIGURE 2 Direct-message exchange between 전███████ (Je██████████) and 최█████ (C███████), 22 Oct 2026, 11:00 to 11:31 JST: target sectors and countries, staging IPs, AI-assisted PoC ranking, first spreadsheet due 25/10.
PLANNED LAUNCH
No specific launch date or window has been stated by the handlers as of 22 October 2026. The closest statement is C███████’s: “█████ country-and-sector target spreadsheet █████.” The channel remains under continuous monitoring.
Translated transcript (loose translation from Korean)
THREAT ACTOR 1 = 전███████ (Je██████████). THREAT ACTOR 2 = 최█████ (C███████). All times 22 October 2026, JST.
Je██████████ · ~11:00 JST
█████ PHP runtime issues █████ internet-facing systems █████ national agencies, banks and financial institutions, manufacturing, logistics, shipping, airports and aviation, online transaction platforms, trading companies, and construction firms. Priority regions: USA, Japan, Thailand, Indonesia, Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia, and the EU.
C███████ · ~11:04 JST
█████ passive collection of public banners and version strings for anything advertising PHP. █████ stay off anything that looks already heavily monitored.
Je██████████ · ~11:07 JST
█████ Separate the list by country and sector █████ government and financial sites first, then logistics, ports, airports, and manufacturing. █████ staging and collection points █████
C███████ · ~11:12 JST
█████ intermediaries for hosting the target lists. █████ not perform active scans. █████ public GitHub notes and researcher write-ups █████
Je██████████ · ~11:15 JST
█████ public information only. Do not invent new primitives. █████ out-of-memory path █████ stale-state path. █████ common Apache and FPM setups without needing local access.
C███████ · ~11:19 JST
█████ public technical descriptions █████ local AI for reconnaissance and to rank █████ public repositories █████ manually verify █████ controlled lab █████
Je██████████ · ~11:23 JST
AI is only for speed on sorting and validation of open material. █████ shortlist of likely-vulnerable hosts █████ No broad noisy scanning █████
C███████ · ~11:27 JST
█████ country-and-sector target spreadsheet █████ Collection points stay on the infrastructure █████ flag any hosts that appear to have already applied the 21 October patches.
Je██████████ · ~11:31 JST
█████ first filtered list █████ public approaches █████ worth adapting.
Source: CYFIRMA closed-source collection, I2P channel █████ ██ ██ (████████████████), 22 October 2026.
Expected attack path (MITRE ATT&CK)
Mapped from intercepted tasking, open-source exploitation telemetry and historical Lazarus web tradecraft. One unauthenticated multipart POST can reach code execution before any application code runs; there is no vulnerable route to discover and little application-layer trace.
| PHASE | ANTICIPATED ACTIVITY | ATT&CK |
| Reconnaissance | Passive banner / version fingerprinting of PHP; country- and sector-segmented target list building; probing multipart endpoints and session upload-progress; AI-assisted ranking of public PoCs | T1595.002 · T1590.005 |
| Resource Development | Acquisition/adaptation of public PHP2Shell exploit code; staging on campaign infrastructure; lab validation before use | T1588.005 · T1608.001 · T1583.004 |
| Initial Access | Exploitation of CVE-2026-109618 / -109619 via crafted multipart/form-data for unauthenticated RCE; highest success on Apache mod_php | T1190 |
| Execution & Persistence | Command execution as web-worker user; PHP/ASP web-shell deployment in web roots; cron and SSH-key implants; abandoned-config persistence | T1059.004 · T1505.003 · T1053.003 · T1098.004 |
| Credential Access & Collection | Harvesting of wp-config.php, .env, database credentials and API keys; ~67 KB memory disclosure via PHPSESSID; config/file reads via OPcache primitive | T1552.001 · T1005 |
| C2 & Impact | Loader fetch-and-run from staging host (Mirai convention); outbound C2 from web workers; cryptomining, ransomware, lateral movement; data exfiltration | T1105 · T1210 · T1041 · T1496 · T1486 |
Assessment: June 2026 Minjun is linked to the Lazarus Group ecosystem (DPRK) with MODERATE confidence. The assessment rests on behavioural and linguistic indicators rather than definitive infrastructure or malware-family overlap. Public reporting as of 22 October 2026 had not attributed PHP2Shell exploitation to any named actor; this assessed link is based on CYFIRMA collection.
DESIGNATION
Lazarus Group ecosystem. Korean-speaking operator / small team; handles 전███████ (Je██████████) and 최█████ (C███████)
ATTRIBUTION
State-nexus · North Korea (DPRK). Reconnaissance General Bureau (RGB) / Bureau 121 and subordinate offensive cyber units
KNOWN ALIASES
APT38, Hidden Cobra, ZINC, Diamond Sleet. Related clusters: BlueNoroff, Andariel, Kimsuky
ACTIVE SINCE
Handles active since March 2026. Campaign discussion first observed 22 Oct 2026 (≈11:00 JST)
LINK CONFIDENCE
MODERATE
OPERATIONAL STYLE
Disciplined, access-focused. Harvests public PoCs, ranks them with AI, lab-validates before use, avoids noisy scanning
CYFIRMA assesses with moderate confidence that the operator is linked to the North Korean state-sponsored threat ecosystem directed by the Reconnaissance General Bureau (RGB), the DPRK military intelligence organisation widely assessed to oversee Bureau 121 and its subordinate offensive cyber units. The Lazarus Group is the umbrella designation most consistent with the observed language, operational style and historical targeting of web infrastructure.
Assessed objectives. Monetise broad, opportunistic PHP2Shell access through deliberate, high-value targeting: initial-access resale, cryptocurrency theft, ransomware precursors and credential theft, fused with state-nexus espionage against government and financial institutions first, then logistics, ports, airports and manufacturing.
Historical targeting and PHP / web tradecraft
The Lazarus ecosystem at a glance
“Lazarus” is best understood as a family of related RGB-directed clusters that share tooling, infrastructure and tasking. Any of the clusters below, or a shared access team feeding them, could operationalise PHP2Shell access.
| CLUSTER (COMMON ALIASES) | PRIMARY MANDATE | RELEVANCE TO PHP2SHELL |
| Lazarus Group (APT38, Hidden Cobra, ZINC, Diamond Sleet) | Financial theft at scale; destructive operations; espionage | Documented use of compromised web servers and web shells for C2 and staging; opportunistic mass-RCE weaponisation |
| APT38 / BlueNoroff (Sapphire Sleet, Stardust Chollima) | Financial institutions, SWIFT networks, cryptocurrency and DeFi theft | BFSI and crypto/trading platforms are top-tier targets in the intercepted tasking |
| Andariel (Silent Chollima, Onyx Sleet, DarkSeoul) | Espionage against defence, aerospace, healthcare; opportunistic ransomware | Watering-hole and web-server compromise tradecraft (e.g. SyncHole); ransomware precursor risk |
| Kimsuky (Velvet Chollima, Emerald Sleet, APT43) | Strategic intelligence collection; spear-phishing; credential theft | May consume web-server footholds for collection and onward credential harvesting |
Structured assessment of the Lazarus link
| SUPPORTS DPRK / LAZARUS ASSESSMENT | UNCERTAINTIES / ALTERNATIVE EXPLANATIONS |
| Korean-language operational tasking in a closed, OPSEC-conscious I2P channel | Language alone is not attribution; could reflect a Korean-speaking criminal crew without state direction |
| Sector prioritisation (government + BFSI first) mirrors the Lazarus dual mandate | Government and BFSI are high-value to many financially motivated actors |
| Geographic spread and interest in trading/crypto platforms align with APT38/BlueNoroff | Open-source PHP2Shell exploitation is broadly opportunistic and multi-actor |
| Historical Lazarus use of PHP/web-shell tradecraft and compromised web C2 | No confirmed malware-family or infrastructure overlap with a named Lazarus cluster yet |
| Disciplined, access-focused tradecraft (AI-assisted PoC triage, lab validation, scan avoidance) | Tradecraft discipline is increasingly common across capable criminal groups |
Net assessment: MODERATE confidence in a Lazarus-ecosystem link. Confidence will be revised upward on observation of infrastructure or tooling overlap with a named cluster, a launch statement, or confirmed compromises; and revised downward if collection indicates an unaffiliated Korean-speaking criminal group.
Industries and geographies (from June 2026 Minjun tasking, 22 October 2026)
| PRIORITY | SECTORS | GEOGRAPHIES |
| Tier 1 | National government agencies; banks and financial institutions | US, Japan, Korea, UAE, EU, Thailand, Indonesia, Saudi Arabia |
| Tier 2 | Manufacturing; logistics, shipping and ports; airports and aviation | Thailand, Indonesia, Australia, Taiwan, India, Japan, UAE |
| Tier 3 | Online transaction / trading platforms; trading companies; construction | Singapore, UAE, Saudi Arabia and broader EU |
Technologies
All internet-facing PHP runtimes: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed (LSAPI), and embedded PHP in appliances and hosting control panels (cPanel, Plesk). Highest risk: unpatched Apache mod_php. No specific customer hosts were named in-channel; the campaign is global and begins opportunistic before narrowing to a filtered, prioritised list.
Technical note: no host-level verification (ASN / provider, port, path, response, certificate CN/O, stack) is possible at this stage because the handlers have not yet produced a filtered host list.
| DIMENSION | ASSESSMENT |
| Likelihood | HIGH. Public exploit tooling is circulating (varying reliability); scanning and early exploitation have been confirmed by multiple vendors (Amazon MadPot, Cloudflare, Hadrian, Patchstack) before and immediately after patch release on 21 October 2026. The June 2026 Minjun operators, a disciplined, suspected DPRK-nexus actor, are actively planning sector- and geography-specific targeting. |
| Potential impact | CRITICAL. Unauthenticated RCE on internet-facing PHP enables web-shell deployment, credential and configuration theft, data exfiltration, cryptomining, ransomware and lateral movement, independent of the CMS, framework or plugins in use. For Lazarus-ecosystem targeting, the realistic worst case extends to financial theft, destructive operations and long-term espionage access. Regulatory (GDPR, sectoral), financial and reputational consequences are severe. |
| Overall severity | CRITICAL. Confidence HIGH (Lazarus-ecosystem link MODERATE). |
| Time sensitivity | IMMEDIATE. Patches have been available since 21 October 2026; the remediation window before mass weaponisation is closing. End-of-life PHP (8.1 and earlier) has no official upstream fix. Forensic visibility is poor (the bug fires before application code runs), so detection must lean on process and network telemetry, and investigations should start from 17 October 2026. |
Indicators are defanged in tables. Several addresses are shared or anonymising infrastructure; investigate sightings before blocking.
A. June 2026 Minjun campaign infrastructure (captured from adversary conversation, 22 October 2026)
Fifteen IPv4 addresses shared in-channel for staging, target-list hosting and launch, plus one possible variant (entry 16). Infrastructure roles are not fully differentiated. Entry 16 appears once, only in the direct-message exchange, and may be an actor typo of entry 4; it is included as a precaution. Priority: MONITOR & HUNT.
| # | IPv4 | ROLE |
| 1 | 146.70.114[.]180 | Staging / target-list hosting / launch |
| 2 | 146.70.114[.]182 | Staging / target-list hosting / launch |
| 3 | 147.175.149[.]67 | Staging / target-list hosting / launch |
| 4 | 147.78.168[.]57 | Staging / target-list hosting / launch |
| 5 | 109.56.219[.]150 | Staging / target-list hosting / launch |
| 6 | 158.173.75[.]178 | Staging / target-list hosting / launch |
| 7 | 185.203.18[.]54 | Staging / target-list hosting / launch |
| 8 | 185.235.212[.]105 | Staging / target-list hosting / launch |
| 9 | 103.77.210[.]80 | Staging / target-list hosting / launch |
| 10 | 128.90.176[.]13 | Staging / target-list hosting / launch |
| 11 | 138.199.34[.]201 | Staging / target-list hosting / launch |
| 12 | 145.255.150[.]25 | Staging / target-list hosting / launch |
| 13 | 149.102.232[.]44 | Staging / target-list hosting / launch |
| 14 | 149.102.232[.]93 | Staging / target-list hosting / launch |
| 15 | 158.173.242[.]133 | Staging / target-list hosting / launch |
| 16 | 147.78.168[.]67 | Staging / target-list hosting / launch (DM only; possible actor typo) |
B. Suspected source IPs: web shell tooling and upload-progress session poisoning (identified 23 October 2026)
Identified within an 8-hour window. Not, on their own, linked to the DPRK-nexus channel. Priority: BLOCK / MONITOR; hunt in logs for prior contact.
| # | IPv4 | # | IPv4 |
| 1 | 102.207.250[.]188 | 10 | 134.209.252[.]157 |
| 2 | 94.154.43[.]185 | 11 | 119.63.72[.]54 |
| 3 | 75.119.143[.]189 | 12 | 138.68.161[.]170 |
| 4 | 117.203.73[.]63 | 13 | 95.216.5[.]90 |
| 5 | 146.190.107[.]103 | 14 | 103.21.161[.]105 |
| 6 | 95.217.164[.]124 | 15 | 115.96.27[.]126 |
| 7 | 124.122.142[.]142 | 16 | 185.207.232[.]121 |
| 8 | 188.80.228[.]122 | 17 | 78.47.85[.]99 |
| 9 | 134.209.181[.]133 |
Observed techniques
| TECHNIQUE | DESCRIPTION |
| PHP web shell tooling | Deployment or use of PHP-based web shells commonly leveraged for remote code execution, persistence and post-exploitation on compromised web servers. |
| Upload progress session poisoning | Exploitation of PHP’s session upload progress feature (via specially crafted multipart/form-data requests) to poison session data. This can be used to achieve remote code execution or session hijacking under certain configurations, when session data is improperly handled or when combined with local file inclusion or related weaknesses. |
C. Corroborating open-source exploitation infrastructure
Published by primary sources (Amazon, ELLIO, VulnCheck, Vega) as corroborating evidence of active PHP2Shell exploitation.
| INDICATOR | TYPE | CONTEXT | PRIORITY |
| 92.118.112[.]100 | IPv4 | Dropper staging host | BLOCK FIRST (egress) |
| hxxp://92.118.112[.]100/nfs | URL / staging | Mirai-style loader fetched to /tmp, run with arg ‘php’ | BLOCK FIRST (egress) |
| 103.216.220[.]92 | IPv4 | Pre-disclosure exploit attempt, 17 Oct (Amazon MadPot) | MONITOR & HUNT |
| php2shell-scan/109618 | User-Agent | Leak-derived scanner (Amazon, VulnCheck, ELLIO) | DETECT |
| php2shell-verify/1.0 · php2shell-109618 | User-Agent | Same scanner family, verification stage | DETECT |
| Mozilla/5.0 (php2shell-poc) | User-Agent | Public-PoC exploitation (VulnCheck, Vega) | DETECT |
| —-p2s… / —-p2shell | Multipart boundary | OOM exploit kit boundary prefix (ELLIO) | DETECT |
| uname -a; id; echo JACKALPOC | Command / canary | Blind-RCE validation; JACKALPOC in a response = execution | DETECT |
D. Malware hashes
| HASH | TYPE | FAMILY / NOTE |
| 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 | SHA-256 | ‘nfs’ second stage (ELF x86-64, stripped, 179,632 bytes); single honeypot vendor report, not independently corroborated |
| b61a098fc62a2c2696e196dca78da71a | MD5 | ‘nfs’ second stage |
E. Behavioural and host indicators (highest value)
The strongest single signal is a PHP or web-server process spawning something it never normally spawns. Request-side signals are useful but noisy; application logs will usually show nothing because no application code ran. Hunt from 17 October 2026 onward.
Sigma: PHP worker spawns shell or download tool
title: PHP2Shell – Shell/Download Tool Spawned by PHP Worker
status: experimental
logsource:
product: linux
category: process_creation
detection:
parent:
ParentImage|endswith: [‘/php-fpm’, ‘/php-cgi’, ‘/httpd’, ‘/apache2’, ‘/lsphp’, ‘/frankenphp’]
child:
Image|endswith: [‘/sh’, ‘/bash’, ‘/dash’, ‘/curl’, ‘/wget’, ‘/nc’, ‘/busybox’, ‘/python3’, ‘/perl’]
tmp:
Image|startswith: [‘/tmp/’, ‘/var/tmp/’, ‘/dev/shm/’]
condition: parent and (child or tmp)
level: high
tags:
– attack.t1190
– attack.t1059.004
Sigma: request-side tool indicators (web/WAF logs)
title: PHP2Shell – Known Tool User-Agents / Upload-Progress Field
status: experimental
logsource:
category: webserver
detection:
ua:
cs-user-agent|contains: [‘php2shell-scan’, ‘php2shell-109618’, ‘php2shell-verify’, ‘php2shell-poc’]
post:
cs-method: ‘POST’
body:
cs-body|contains: [‘PHP_SESSION_UPLOAD_PROGRESS’, ‘—-p2s’, ‘JACKALPOC’]
condition: ua or (post and body)
level: medium
Splunk: PHP worker child processes
index=edr parent_process_name IN (“php-fpm*”,”php-cgi*”,”httpd”,”apache2″,”lsphp”,”frankenphp”)
(process_name IN (“sh”,”bash”,”curl”,”wget”,”nc”,”busybox”,”python3″,”perl”)
OR process_path=”/tmp/*” OR process_path=”/dev/shm/*”)
earliest=”10/17/2026:00:00:00″
| stats count min(_time) as first values(process) as cmd by host user
| sort – count
Quick host triage (read-only)
php -v # confirm the SERVING binary, not only CLI
php -i | grep -E ‘session.upload_progress|memory_limit|post_max_size|max_input_nesting_level|fatal_error_backtraces|opcache.enable’
find /var/www -type f -name ‘*.php’ -newermt ‘2026-10-17’ -ls
find /tmp /var/tmp /dev/shm -type f -perm -u+x -newermt ‘2026-10-17’ -ls
grep -rIl -e ‘92.118.112.100’ -e ‘JACKALPOC’ /var/log 2>/dev/null
YARA
PHP2Shell exploitation happens in PHP worker memory before application code runs and writes no file by itself, so YARA cannot detect the exploit directly. It covers what the attack leaves behind: captured requests and logs, PHP session files, second-stage payloads and web shells dropped after successful RCE, and staged exploit tooling.
Validation status: the set compiles cleanly with yara-python 4.5.4 with warnings treated as errors, and passed a 72-case synthetic regression suite. It has not yet been tested against real application code; run it against clean WordPress, Drupal, and Magento installations before deploying for alerting. Full rule text is in Appendix A.
| RULE | WHAT IT DETECTS AND WHERE TO SCAN | SEVERITY |
| PHP2Shell_SecondStage_ELF_SHA256 | The second-stage ELF x86-64 binary (SHA-256 and exact size). Scan /tmp, /var/tmp, /dev/shm and web roots; the loader may delete the file after launch. | High |
| PHP2Shell_Captured_Request_Body_SHA256 | Saved scanner and OOM-tool request bodies by exact hash. Fragile: any change to boundary or field values defeats it. | Medium |
| PHP2Shell_Infrastructure_IPs_In_Content | Published anonymisation-network, scanner and staging IPs in logs and text content. A hit means investigate, not confirmed compromise. | Medium |
| PHP2Shell_Request_Shape_In_Capture | Scanner user-agents, boundaries, the JACKALPOC marker, or the exploit request shape. Run on per-request captures, not multi-request logs. | Medium |
| PHP2Shell_Log_Crash_Signatures | PHP and PHP-FPM log lines from trigger attempts. Side effects, not proof; correlate with multipart POSTs from the same source. | Low |
| PHP2Shell_Session_File_Anomaly | Session files (sess_*) containing PHP code, or a residual upload-progress entry with an empty-filename spray. | Medium |
| PHP_Webshell_Input_To_Exec_Heuristic | Generic web shells passing request input to execution or evaluation. Not PHP2Shell-specific; validate hits against application code. | Medium |
| PHP_Suspicious_Command_Execution_Hunting | Broad hunting for PHP files combining command execution with shell paths, request input or decoding. Hunting only, not alerting. | Low |
| PHP2Shell_Public_PoC_Script | Staged exploit scripts referencing PHP2Shell CVEs or tooling strings with the upload-progress field. Hits on analyst systems may also mean a trojanised PoC. | Low |
Deployment notes: seven of the nine rules match the rule file itself and other detection content; exclude rule repositories and threat-intelligence feeds from scans. User-agent, boundary and marker strings are trivially changed by attackers; weight the request-shape, session-file and payload rules over string matches.
| PRIORITY | ACTION |
| P1 · NOW | Inventory every PHP runtime (VMs, containers, Kubernetes, appliances, CI/CD, shared hosting, bundled PHP in vendor software). Prioritise internet-facing systems; confirm the live web-serving process version (Apache/FPM), not only the CLI binary. |
| P1 · NOW | Patch to PHP 8.5.12+, 8.4.27+, 8.3.36+ or 8.2.35+ (or a verified vendor/distribution backport). Restart ALL PHP workers and validate the running binary; a reload that keeps old workers alive leaves the stale state in place. |
| P1 · NOW | Isolate or take offline any internet-facing PHP that cannot be patched within hours. Highest priority: Apache mod_php. Organisations in the prioritised sectors and geographies (Section 07) should treat this as urgent. |
| P1 · NOW | Block or closely monitor traffic from the 17 suspected source IPs (Section 09 B) at the perimeter and host level. |
| P1 · NOW | Temporary controls (do not replace patching; PHP states a fixed release is the only complete mitigation): CVE-2026-109618: memory_limit = -1 (admin-enforced via php_admin_value); set a low post_max_size (8M where uploads are not required, 32M where they are); constrain multipart body size, part and header counts at the reverse proxy; lower max_input_nesting_level to 32; use cgroup/container memory boundaries (not RLIMIT_AS/RLIMIT_DATA). CVE-2026-109619: session.upload_progress.enabled = 0 (administrative config, not ini_set); fatal_error_backtraces = 0 (PHP 8.5); remove pre-init diagnostics and attacker-reachable fatal paths; pm.max_requests = 1 where performance allows. Defence in depth: deploy/confirm WAF protections as a supplement; lock origins to CDN/WAF ranges so attackers cannot bypass to the origin IP; egress-filter web workers and block 92.118.112[.]100 / hxxp://92.118.112[.]100/nfs. |
| P2 · 72H | Hunt for reconnaissance or exploitation since 17 October 2026: malformed multipart POSTs, session upload-progress anomalies, PHP worker crashes/OOM, web-server processes spawning shells, new PHP files in web roots, and any contact with the Section 09 indicators. |
| P2 · 72H | If compromise is suspected: preserve volatile evidence BEFORE patching (restarting workers destroys CVE-2026-109619 state), capture memory and logs, isolate the host, rebuild from a trusted patched image, and rotate all secrets accessible to the PHP worker. |
| P3 · 7 DAYS | Notify relevant national CERTs and sector coordination channels; brief leadership. Watch for I2P egress and for the June 2026 Minjun infrastructure in Section 09 A. Continue monitoring for a launch statement or Lazarus-linked exploitation. |
This report consolidates CYFIRMA closed-source channel collection (I2P human-intelligence monitoring), verified vulnerability intelligence (PHP Security Team advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp), open-source in-the-wild exploitation telemetry (Amazon MadPot, Cloudflare, Hadrian, Patchstack, VulnCheck, ELLIO, Vega), public exploit/PoC evidence (Wiz / Calif / OpenAI, Datadog Security Labs, VulnCheck, GitHub, JFrog, AhnLab ASEC), and historical Lazarus tradecraft analysis. No exploit code has been executed or independently tested in this assessment.
Source credibility.
| SOURCE TYPE | CREDIBILITY AND BIAS |
| PHP Security Team advisories and GHSAs | Primary and authoritative. High credibility. |
| Discoverers (Calif, Wiz, OpenAI, Quarkslab) | High credibility on the vulnerability; security vendors and an AI research organisation with commercial interest in the disclosure; promotional in tone. |
| Exploitation telemetry vendors (Amazon, Cloudflare, Hadrian, Patchstack, VulnCheck, ELLIO, Vega) | Credible; commercial interest; each sees only its own sensors or customers. "Exploited in the wild" generally means attempts observed. |
| CYFIRMA closed-source collection | Proprietary human intelligence. Sourcing detail is withheld to protect collection. |
Confidence justification. PHP2Shell technical details, the June 2026 Minjun campaign’s targeting intent and channel activity are directly observed or independently verified, supporting HIGH confidence in the vulnerability and the general threat. Confidence in the link to the Lazarus ecosystem is MODERATE because it rests on language, operational pattern, and historical tradecraft rather than definitive infrastructure or tooling overlap with a named Lazarus cluster. No confirmed mass successful exploitation by this actor has been observed. CYFIRMA will revise this assessment on further tasking, infrastructure differentiation, or confirmed compromises. The channel remains under continuous monitoring; next review 25 October 2026.
Media and analyst contact: [email protected]
TLP:CLEAR – Recipients may share this information without restriction, subject to standard copyright rules.
Place the rules in one .yar file that starts with the import line below, which the two hash-based rules (A.1 and A.2) require.
import “hash”
rule PHP2Shell_SecondStage_ELF_SHA256
{
meta:
description = “Detects the PHP2Shell second-stage ELF x86-64 binary delivered by the observed loader”
author = “CYFIRMA Research”
date = “2026-10-22”
category = “Threat Intelligence”
severity = “High”
hash = “0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486”
source_note = “Single honeypot vendor, 21 Oct 2026; not independently corroborated”
scan_scope = “/tmp, /var/tmp, /dev/shm, web roots. The loader writes to /tmp and executes; the file may be deleted after launch”
condition:
uint32(0) == 0x464C457F and
filesize == 179632 and
hash.sha256(0, filesize) == “0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486”
}
rule PHP2Shell_Captured_Request_Body_SHA256
{
meta:
description = “Matches saved PHP2Shell scanner and OOM-tool HTTP request bodies by SHA-256”
author = “CYFIRMA Research”
date = “2026-10-22”
category = “Threat Intelligence”
severity = “Medium”
note = “Hashes of HTTP request bodies, not files. Matches only a body extracted byte-for-byte (PCAP, WAF or proxy capture); any change to boundary or field values changes the hash. A.4 is the durable alternative”
condition:
filesize < 2MB and
(
hash.sha256(0, filesize) == “43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a” or
hash.sha256(0, filesize) == “7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6”
)
}
rule PHP2Shell_Infrastructure_IPs_In_Content
{
meta:
description = “Finds PHP2Shell-associated IPs (six anonymisation-network IPs, three scanner/exploitation IPs and one payload staging host) in logs and other text content”
author = “CYFIRMA Research”
date = “2026-10-22”
category = “Threat Intelligence”
severity = “Medium”
note = “ip1 to ip6 are shared anonymisation infrastructure; ip7 is the second-stage staging host; ip8 to ip10 were reported by a second sensor network (ip8 and ip9 scanning with the php2shell-scan user-agent, ip10 attempting both CVEs). A hit means investigate, not confirmed compromise. String matching only; not network connection detection. Will also match threat-intel feeds and exit-node lists stored on disk”
strings:
$ip1 = “103.216.220.92” ascii wide fullword
$ip2 = “31.223.184.166” ascii wide fullword
$ip3 = “37.19.200.5” ascii wide fullword
$ip4 = “134.209.159.64” ascii wide fullword
$ip5 = “103.114.163.188” ascii wide fullword
$ip6 = “95.217.98.37” ascii wide fullword
$ip7 = “92.118.112.100” ascii wide fullword
$ip8 = “85.11.167.243” ascii wide fullword
$ip9 = “45.198.224.169” ascii wide fullword
$ip10 = “109.71.252.97” ascii wide fullword
condition:
any of them
}
rule PHP2Shell_Request_Shape_In_Capture
{
meta:
description = “PHP2Shell scanner/PoC strings or exploit request shape in captured HTTP requests”
author = “CYFIRMA Research”
date = “2026-10-22”
category = “Threat Hunting”
severity = “Medium”
scan_scope = “Per-request captures: ModSecurity audit log entries, WAF/proxy body dumps, PCAP-extracted bodies. Counts aggregate across the whole file, so do not run the shape branch on multi-request logs”
note = “UA, boundary and marker strings come from honeypot and community reporting of public tooling and are trivially changed. JACKALPOC in a captured response (not request) indicates the validation command ran. The upload-progress field name is configurable (session.upload_progress.name)”
strings:
$ua1 = “php2shell-scan” ascii nocase
$ua2 = “php2shell-verify” ascii nocase
$ua3 = /php2shell-1096[0-9]{2}/ ascii nocase
$bnd1 = “—-p2s” ascii
$bnd2 = “B7kQpoc619” ascii
$marker = “JACKALPOC” ascii
$field = “PHP_SESSION_UPLOAD_PROGRESS” ascii
$empty_file = “filename=\”\”” ascii
$array_part = /name=”[A-Za-z0-9_]{1,32}\[\]”/ ascii
condition:
filesize < 20MB and
(
any of ($ua*, $bnd*, $marker) or
($field and #empty_file >= 10) or
($field and #array_part >= 100)
)
}
rule PHP2Shell_Log_Crash_Signatures
{
meta:
description = “PHP error-log and PHP-FPM log lines consistent with PHP2Shell trigger attempts (pre-request OOM, session decode failure, worker segfault)”
author = “CYFIRMA Research”
date = “2026-10-22”
category = “Threat Hunting”
severity = “Low”
note = “Side-effect indicators, not proof of exploitation. Derived from community lab testing (largely PHP CLI server; nginx/FPM/Apache mappings provisional). Correlate with multipart POSTs from the same source. A memory-limit fatal with memory_limit=-1 set is a strong signal”
strings:
$oom = /Allowed memory size of [0-9]{1,12} bytes exhausted[^\n]{0,200} in Unknown on line 0/ ascii
$decode = “Failed to decode session object” ascii
$segv = “exited on signal 11 (SIGSEGV)” ascii
condition:
$oom or ($decode and $segv)
}
rule PHP2Shell_Session_File_Anomaly
{
meta:
description = “PHP session file containing PHP code or a residual upload-progress entry with an empty-filename spray”
author = “CYFIRMA Research”
date = “2026-10-22”
category = “Threat Hunting”
severity = “Medium”
scan_scope = “Session save_path, e.g. /var/lib/php/sessions or /tmp (sess_* files)”
note = “Branch A (PHP code) covers webshell staging via a poisoned session file, which the upload-progress feature makes possible. Branch B is unvalidated: upload-progress entries are normally removed on completion (session.upload_progress.cleanup=On), so a residual entry with many empty filenames is an anomaly worth review. Prefix is configurable (session.upload_progress.prefix). Covers php, php_serialize and php_binary handlers. Branch A can match applications that keep code snippets in session data”
strings:
$prefix = “upload_progress_” ascii
$php1 = “= 10)
)
}
rule PHP_Webshell_Input_To_Exec_Heuristic
{
meta:
description = “PHP files that pass request input to command execution or code evaluation, use an execution function as a string callback, evaluate the raw request body, or open a reverse shell”
author = “CYFIRMA Research”
date = “2026-10-22”
category = “Behavioural Detection”
severity = “Medium”
note = “Post-exploitation webshell detection in web roots; not PHP2Shell-specific. Validate hits against legitimate application code”
strings:
$php1 = “:$](system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec|assert|eval)\s*\(\s*((base64_decode|str_rot13|gzinflate|gzuncompress|rawurldecode)\s*\(\s*)*\$_(GET|POST|REQUEST|COOKIE|SERVER)/ nocase
// backtick operator executing request input
$backtick = /`[^`\n]{0,200}\$_(GET|POST|REQUEST|COOKIE)/
// variable function called with request input, e.g. $f($_REQUEST[‘x’])
$var_func = /\$[a-zA-Z_][a-zA-Z0-9_]*\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)\s*\[/
// request input used as the function name, e.g. $_GET[‘f’]($_GET[‘c’])
$input_func = /\$_(GET|POST|REQUEST|COOKIE)\s*\[[^\]\n]{1,40}\]\s*\(/
// execution function passed as a string callback, e.g. call_user_func(‘system’, …)
// (callback as first argument; method callbacks such as array($pdo, ‘exec’) are deliberately not matched)
$str_cb1 = /(call_user_func(_array)?|array_map|register_shutdown_function)\s*\(\s*[‘”](system|exec|shell_exec|passthru|popen|proc_open|assert)[‘”]/ nocase
// (callback as second argument after an array variable)
$str_cb2 = /(array_filter|array_walk|usort|uasort|uksort)\s*\(\s*\$[A-Za-z0-9_]{1,40}\s*,\s*[‘”](system|exec|shell_exec|passthru|popen|proc_open|assert)[‘”]/ nocase
// raw request body evaluated or included
$php_input = /(eval|assert|include|include_once|require|require_once)\s*\(?\s*(file_get_contents\s*\(\s*)?[‘”]php:\/\/input/ nocase
// reverse shell: socket plus interactive shell
$fsock = /fsockopen\s*\(/ nocase
$shell_i = /\/bin\/(ba)?sh -i|\/dev\/tcp\//
condition:
filesize < 1MB and
any of ($php*) and
(
$direct or $backtick or $var_func or $input_func or $str_cb1 or $str_cb2 or $php_input or
($fsock and $shell_i)
)
}
rule PHP_Suspicious_Command_Execution_Hunting
{
meta:
description = "Broad hunting rule for PHP files combining command execution with shell paths, request input or decoding"
author = "CYFIRMA Research"
date = "2026-10-22"
category = "Threat Hunting"
severity = "Low"
note = "Hunting only, not for alerting or blocking; expect false positives. Triage hits by location in the web root, ownership by the web-server or PHP worker account, and creation or modification on or after 17 Oct 2026"
strings:
$php1 = "exec, ::exec), variables ($exec) and longer names (curl_exec, filesystem)
$exec1 = /[^A-Za-z0-9_>:$]shell_exec\s*\(/ nocase
$exec2 = /[^A-Za-z0-9_>:$]proc_open\s*\(/ nocase
$exec3 = /[^A-Za-z0-9_>:$]popen\s*\(/ nocase
$exec4 = /[^A-Za-z0-9_>:$]passthru\s*\(/ nocase
$exec5 = /[^A-Za-z0-9_>:$]system\s*\(/ nocase
$exec6 = /[^A-Za-z0-9_>:$]exec\s*\(/ nocase
$exec7 = /[^A-Za-z0-9_>:$]pcntl_exec\s*\(/ nocase
$shell1 = “/bin/sh” ascii
$shell2 = “/bin/bash” ascii
$shell3 = “sh -c” ascii nocase
$in1 = “$_GET[” ascii
$in2 = “$_POST[” ascii
$in3 = “$_REQUEST[” ascii
$in4 = “$_COOKIE[” ascii
$decode1 = /[^A-Za-z0-9_>:$]base64_decode\s*\(/ nocase
$decode2 = /[^A-Za-z0-9_>:$]eval\s*\(/ nocase
$decode3 = /[^A-Za-z0-9_>:$](gzinflate|gzuncompress|str_rot13)\s*\(/ nocase
condition:
filesize < 5MB and
any of ($php*) and
(
(2 of ($exec*) and 1 of ($shell*)) or
(1 of ($exec*) and 1 of ($shell*) and 1 of ($in*)) or
(1 of ($exec*) and 1 of ($decode*) and 1 of ($in*)) or
// small file calling an execution function with request input anywhere (indirect webshells, e.g. $c=$_GET['c']; system($c);)
(filesize < 8KB and 1 of ($exec*) and 1 of ($in*)) or
// small file evaluating decoded request input indirectly, e.g. $p=base64_decode($_POST['p']); eval($p);
(filesize < 8KB and $decode2 and 1 of ($decode1, $decode3) and 1 of ($in*))
)
}
rule PHP2Shell_Public_PoC_Script
{
meta:
description = "Scripts that reference PHP2Shell CVEs or tooling strings together with the upload-progress field"
author = "CYFIRMA Research"
date = "2026-10-22"
category = "Threat Hunting"
severity = "Low"
note = "Finds staged exploit tooling on compromised hosts or analyst systems. Security firms warned that circulating PoCs may contain malware; treat hits on analyst systems as possible infection too. Matches detection-content files holding the same strings; exclude rule repositories"
strings:
$field = "PHP_SESSION_UPLOAD_PROGRESS" ascii wide
$t1 = "php2shell" ascii wide nocase
$t2 = "CVE-2026-109618" ascii wide nocase
$t3 = "CVE-2026-109619" ascii wide nocase
$t4 = "B7kQpoc619" ascii wide
$t5 = "JACKALPOC" ascii wide
$code1 = "import requests" ascii
$code2 = "requests.post" ascii
$code3 = "socket.socket" ascii
$code4 = "curl_init" ascii
condition:
filesize < 1MB and
uint32(0) != 0x464C457F and
$field and
1 of ($t*) and
1 of ($code*)
}
