October 2026: The latest critical PHP vulnerability, leaked on 20 October 2026, is being used against real targets.
CYFIRMA has obtained the original target list drawn up by a group of Korean-speaking operators, assessed with high confidence as DPRK state-nexus operators within the Lazarus Group ecosystem. The list names 216 internet-facing servers across 10 countries, spanning government, banking, telecommunications and infrastructure providers. That list is captured and in CYFIRMA’s hands; it is not a claim.
Between 25 and 29 October, the same operators reported exploiting two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619 (both CVSS v4.0 9.2), and claimed a wider scope of 581 hosts. The 581 figure, and the compromise of any individual host, are operator claims that CYFIRMA has not independently verified.
The action is the same either way: patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a verified vendor backport) and restart every PHP worker today.
By CYFIRMA Research | Published November 2026 | TLP: CLEAR | Reference CYF-FS-2026-1029-PHP2SHELL-DPRK
Status: Severity: critical | Confidence: high (actor); campaign activity confirmed | TLP: CLEAR | Latest advisory: version 4, 29 October 2026
Update log
Key takeaways
PHP2Shell is the name given to two critical, unauthenticated remote code execution flaws in PHP core, tracked as CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2. Technical details leaked on 20 October 2026, ahead of coordinated disclosure, and the PHP Security Team released fixes on 21 October.
The flaws matter because crafted multipart requests reach PHP’s request handling before any application code runs, so no web application, framework, or plugin can defend against them. Triggering the bugs takes one request; reliable code execution usually needs a follow-up request on the same worker. For the root cause and exploitability analysis of each CVE, see the exploitation and vulnerability detail section of the CYFIRMA First Sight advisory.
Any organisation running internet-facing PHP below the fixed versions is affected, whatever application sits on top of it.
| PHP branch | Status | Fix |
| 8.5 | Supported | 8.5.12 |
| 8.4 | Supported | 8.4.27 |
| 8.3 | Security-only | 8.3.36 |
| 8.2 | Security-only | 8.2.35 |
| 8.1, 8.0, 7.4 | End of life | Minimal source backports and vendor builds only; confirm with your vendor |
| 7.3 and older | End of life | No fix; migrate or isolate |
Apache with mod_php (prefork) is the highest-risk setup and should be patched or isolated first.
Yes, if it runs on an unpatched PHP, and updating WordPress will not fix it; the same is true of Drupal, Magento, and Laravel. The flaw lives in the PHP runtime, not in any application or framework built on it. Only patching PHP itself closes the hole.
Check the version of the process that actually serves web traffic, meaning Apache or PHP-FPM, rather than only the command-line php -v, which can point to a different install. Include containers, appliances, and PHP bundled inside vendor software, where an old runtime is easy to miss.
Not everything in this story carries the same weight. The table below, taken from advisory version 4, separates what CYFIRMA holds as fact from what it assesses and from what remains an operator claim.
| Confirmed | Assessed | Not established |
| CYFIRMA obtained the operators’ original 216-host target set across 10 countries. | The actor is a DPRK state-nexus operator within the Lazarus Group ecosystem (high confidence, raised from moderate in versions 1 to 3). | The expansion to 581 hosts is an adversary claim. |
| Both CVEs are unauthenticated RCE flaws in PHP core, each CVSS v4.0 9.2. | Tasking spans financial gain and espionage. | Exploitation of any given host is self-reported by the operators. |
| Low-and-slow weakness checks and initial exploitation attempts are continuing against internet-facing PHP. | Appearing on the list indicates targeting, not compromise. |
CYFIRMA’s closed-source collection surfaced a Korean-speaking actor on a closed I2P channel on 22 October 2026, two days after the PHP2Shell details leaked and one day after fixes shipped. Rather than scanning the whole internet, the operators were building a curated list of servers worth their time.
By 24 October, they reported a completed set of 216 hosts that still advertised older PHP versions. CYFIRMA has since obtained that original list, which is what makes the targeting, as distinct from the exploitation, a confirmed fact.
From 25 to 29 October, the operators reported first-pass results: exploitation attempts, web shells reported on most of the hosts they rated highest-confidence, and an expansion of the working set to 581 hosts.
Their stated order of priority was government and banks first, then logistics and trading platforms. All of this later activity is self-reported, and CYFIRMA has not verified it host by host.
The channel and the operators’ handles are deliberately not named here; the advisory publishes masked transcripts for analysts in its adversary conversation intelligence section.
They also adapt public proof-of-concept code rather than writing their own, rank candidate code with a local AI model, and validate it in a lab before use.
The operators use a local AI model to rank public proof-of-concept repositories and then validate the most promising code in a controlled lab. By their own account, AI is used only for speed in sorting and validating open material; they do not claim to invent new exploitation primitives with it.
CYFIRMA holds this detail with moderate confidence. The practical effect is a shorter gap between public disclosure and a working attack.
CYFIRMA now assesses with high confidence that the operators are DPRK state-nexus operators within the Lazarus Group ecosystem, a judgement raised from moderate confidence in versions 1 to 3.
The assessed mandate is unchanged: financial gain, with espionage against government hosts as a parallel objective. That combination, financially motivated intrusion alongside state collection, is consistent with how the Lazarus ecosystem has operated for years. The structured assessment and the links to known adversaries are set out in the assessment section of the advisory. No malware-family or infrastructure overlap with a named Lazarus cluster has yet been confirmed; the assessment would be lowered if collection pointed to an unaffiliated Korean-speaking group or to deliberate false-flagging.
You can check. The 216-host list CYFIRMA captured is published in masked form (as /24 ranges, grouped by country) in advisory version 4, so organisations can compare it against their own address ranges without publishing individual host addresses (see the captured target set section of the advisory). The address ranges are deliberately not reproduced in this blog.
Two cautions apply.
Targeting, not compromise. Appearing on the list indicates targeting, not compromise: it means the operators selected your server because it advertised an older PHP version, not that they got in.
A snapshot of one stage. The list is a snapshot of one planning stage. The operators have since claimed a wider set, so any organisation still advertising older PHP in the prioritised sectors, government and banking above all, should assume it is in scope whether or not it appears on the list.
| Country | Hosts |
| United States | 49 |
| Japan | 47 |
| India | 31 |
| South Korea | 30 |
| Thailand | 16 |
| United Arab Emirates | 14 |
| Indonesia | 10 |
| Australia | 10 |
| Saudi Arabia | 5 |
| Singapore | 4 |
| Total | 216 |
By region, Asia-Pacific accounts for 148 hosts (68.5%), North America for 49 (22.7%), and the Middle East for 19 (8.8%). The United States and Japan together hold 96 hosts, or 44.4% of the list. The sectors named in the captured list are government, banking, telecommunications, infrastructure providers, and other sectors; earlier advisory versions also named logistics, aviation, manufacturing, trading, and online transaction platforms.
Items marked with an asterisk (*) are adversary claims, not independently verified.
| Date (2026) | Event |
| 17 October | Earliest known exploitation attempt (pre-disclosure) |
| 20 October | Technical details leaked ahead of coordinated disclosure |
| 21 October | PHP Security Team releases fixes (8.5.12, 8.4.27, 8.3.36, 8.2.35) |
| 22 October | Advisory v1: closed channel identified; pre-attack advisory issued |
| 23 October | Advisory v2: 17 suspected source IPs observed in 8 hours |
| 24 October | Advisory v3: operators report a 216-host target set (since captured by CYFIRMA) and 21 compromised scan-node IPs; roughly a third of the set already touched* |
| 25–29 October | Operators report exploitation, web shells opening and an expansion to 581 hosts* |
| 29 October | Advisory v4: original 216-host list captured; 24 more suspected source IPs; attribution raised to high confidence |
Patching is the only complete mitigation. Everything else in this section either buys time or helps you find out whether you were already hit.
Temporary controls reduce exposure but do not replace patching, and they differ by CVE. Disabling session upload progress, for example, helps against CVE-2026-109619 but does nothing for CVE-2026-109618. The advisory sets out the interim control for each flaw in its temporary controls section.
Do not patch first. Isolate the host from the network without restarting it or PHP, then preserve volatile evidence by capturing memory and logs. Rebuild it from a trusted, patched image rather than cleaning it in place, and rotate every secret the PHP worker could have reached: database credentials, API keys, .env contents, and anything in configuration files.
Each of these should have a one-sentence answer.
The last question matters because application logs usually show nothing: the bug fires before application code runs, so detection has to come from the web server, the operating system, or the network.
Unauthenticated remote code execution on internet-facing PHP gives an attacker the same foothold, whatever CMS, framework, or plugins sit on top.
From there, the realistic outcomes are:
For this particular actor, the worst cases are financial theft and espionage against government hosts. Severity: critical. Time sensitivity: immediate.
This warning did not come from a scanner. It came from CYFIRMA’s closed-source human-intelligence monitoring, which surfaced the operators’ planning on a closed channel before most of the targeted servers had been touched.
That collection was then correlated with vulnerability intelligence on the two CVEs and with exploitation telemetry and delivered to customers through DeCYFIR early-warning arrangements, with the public advisory following under TLP: CLEAR.
The value of the approach is the gap it opens: organisations were warned of the campaign on 22 October, while the operators were still building their target list and before the exploitation they reported from 25 October. CYFIRMA describes the broader method in its explainers on External Threat Landscape Management (ETLM) and preemptive cybersecurity.
PHP2Shell is the name given to two critical remote code execution vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, disclosed in October 2026. Both can be triggered by an unauthenticated attacker with a single crafted request. Details were leaked on 20 October 2026, and fixes followed on 21 October.
They are the two CVE identifiers assigned to the PHP2Shell flaws. Each is an unauthenticated remote code execution vulnerability in the PHP runtime, rated CVSS v4.0 9.2. They need different interim controls but the same patch.
As of late October 2026, the latest critical PHP vulnerability is PHP2Shell, covering CVE-2026-109618 and CVE-2026-109619. It is under active exploitation by an actor CYFIRMA assesses as DPRK state-nexus. Fixed versions have been available since 21 October 2026.
Yes. The PHP Security Team released fixed versions on 21 October 2026 for every supported and security-only branch. Patching PHP and restarting all workers is the only complete mitigation.
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and anything newer on those branches. PHP 8.1, 8.0, and 7.4 are end-of-life and depend on vendor builds or minimal source backports. PHP 7.3 and older have no fixes and should be migrated or isolated.
Check the version of the process serving web traffic, Apache or PHP-FPM, rather than relying only on php -v at the command line. Do the same for containers, appliances, and PHP bundled inside vendor software. The running version after a full restart is the one that counts.
No. The flaw is in the PHP runtime, not in any application or framework, so no CMS or framework update can close it. You must patch PHP itself and restart every worker.
Internet-facing servers running PHP below the fixed versions, with Apache mod_php (prefork) the highest-risk configuration. End-of-life branches that cannot take an official patch are also high risk. The operators specifically selected hosts that still advertised older PHP versions.
Yes. The earliest known exploitation attempt dates to 17 October 2026, before public disclosure, and low-and-slow weakness checks and initial exploitation attempts against internet-facing PHP are continuing. The operators tracked by CYFIRMA have reported exploitation and web shells, though those per-host reports are their own claims.
Yes. CYFIRMA obtained the operators’ original target list of 216 internet-facing servers across 10 countries. That list, not the operators’ later claims, is the basis for the confirmed targeting in this blog and the advisory.
Compare your public address ranges against the masked /24 ranges published by country in advisory version 4. Being on the list means you were targeted, not that you were compromised. If you run older internet-facing PHP in government, banking, telecommunications or infrastructure, assume you are in scope either way.
It is the number of hosts the operators claimed to have expanded their campaign to between 25 and 29 October 2026. It is an adversary claim that CYFIRMA has not independently verified. The 216-host figure, by contrast, comes from a list CYFIRMA holds.
CYFIRMA has confirmed the targeting and the ongoing exploitation attempts, but compromise of individual hosts is self-reported by the operators. No organisation should treat its absence from the list, or the absence of a public breach report, as evidence that it is clean. Hunt your logs back to 17 October 2026.
CYFIRMA assesses with high confidence that the operators are DPRK state-nexus operators within the Lazarus Group ecosystem. That confidence was raised from moderate in versions 1 to 3 to high in version 4 of the advisory. The assessed mandate combines financial gain with espionage.
The captured list covers the United States (49 hosts), Japan (47), India (31), South Korea (30), Thailand (16), the UAE (14), Indonesia (10), Australia (10), Saudi Arabia (5), and Singapore (4). Sectors include government, banking, telecommunications, and infrastructure providers, with logistics, aviation, manufacturing, trading, and online transaction platforms named in earlier versions. Asia-Pacific holds 68.5% of the list.
Because a patched host cannot be exploited with these flaws, so it is not worth their time or the risk of exposing their scan nodes. The operators removed hosts that bannered fixed versions, or sat behind heavy filtering, from their list. Where the banner shows a fixed version, patching is likely to take a host out of their pool. It does not remove access already gained, so listed hosts should still be hunted back to 17 October 2026.
To 17 October 2026, the date of the earliest known exploitation attempt. Review web server, WAF, and proxy logs over extended windows rather than looking for spikes, because the operators’ scanning is low-volume and paced.
Isolate unpatchable internet-facing PHP, Apache mod_php first, and apply the per-CVE temporary controls from the advisory. Monitor or block the suspected source addresses. Treat these steps as buying time, not as a fix.
Yes. Disabling session upload progress mitigates CVE-2026-109619 but does nothing for CVE-2026-109618, which needs its own control. The advisory lists the interim control for each; the patch covers both.
No, not against production systems and not without review. Public proof-of-concept code is exactly what the operators are adapting, and running it can crash workers, destroy evidence, or leave a system in an exploitable state. Validate only in an isolated lab, and never paste exploit code into a ticket or chat.
Preserve volatile evidence before you patch, since a restart destroys the state associated with CVE-2026-109619. Isolate the host from the network without restarting it, capture memory and logs, then rebuild it from a trusted patched image and rotate every secret the PHP worker could reach.
Media contact: [email protected]
For analysts. This blog stays at the ‘am I affected and what do I do’ level. The advisory holds the details:
| Topic | Advisory section |
| Root cause, exploitability and public PoC evidence for both CVEs | Exploitation and vulnerability detail |
| Operators’ planning and tradecraft | Adversary conversation intelligence (masked transcripts, v3 and v4); expected attack path (MITRE ATT&CK) |
| Attribution to the Lazarus ecosystem | Links to known adversaries; structured assessment (v1 and v4) |
| Captured target set | Masked /24 ranges by country |
| Recommended actions and per-CVE temporary controls | Recommended actions; temporary controls |
| Hunting and detection | Suspected source infrastructure (v2 to v4); indicators of compromise; detection rules and YARA |
