CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure

Published On : 2026-10-29
Share :
CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure

FIRST SIGHT · THREAT ADVISORY

ACTIVE EXPLOITATION OF PHP2SHELL BY DPRK-Affiliated Group | 216 TARGETS IN 10 COUNTRIES | ACT NOW

Lazarus Group (DPRK)-Linked Operators Claim Exploitation of Two Critical PHP-Core RCE Vulnerabilities, Expanding Target Scope from 216 to 581 Hosts

CYFIRMA has obtained the operators’ original target list, comprising 216 internet-facing servers across 10 countries, spanning government, banking, telecommunications, infrastructure providers, and other sectors. Between 25 and 29 October, the operators reported exploiting CVE-2026-109618 and CVE-2026-109619, both reported with a CVSS v4.0 score of 9.2, and expanded their claimed target scope to 581 hosts.

Version 4 incorporates the captured 216-host target list and 24 additional suspected source IP addresses. The attribution assessment has been raised to HIGH confidence.

TLP:CLEAR

REFERENCE
CYF-FS-2026-1029-PHP2SHELL-DPRK		 ISSUED
29 OCT 2026		 SEVERITY
CRITICAL		 CVSS v4.0
9.2

VERSION INDEX

Four advisories issued over eight days. This consolidation presents them newest-first; each is reproduced in full below under a dated banner.

VERSION DATE ISSUED WHAT THIS VERSION ADDED
Version 4 29 Oct 2026 First Sight re-issue. Operators claim the target set grew from 216 to 581 hosts; full exploitation detail, masked channel transcript and the captured 216-host list (masked).
Version 3 24 Oct 2026 Operators reported a completed 216-host target set and 21 compromised scan-node IPs; channel update and tradecraft.
Version 2 23 Oct 2026 17 suspected source IPs observed performing PHP web-shell tooling and upload-progress session poisoning.
Version 1 22 Oct 2026 Original pre-attack advisory: Lazarus-ecosystem attribution, vulnerability detail, attack path, IOCs, detection content and impact assessment.
HANDLING

This threat advisory is released as TLP:CLEAR. Disclosure is not limited and it may be distributed without restriction, subject to standard copyright rules. All channel conversations are masked.

LATEST RELEASE

VERSION 4 : 29 October 2026

First Sight re-issue. Operators claim the previously identified 216-host set has been expanded to 581 hosts. Full exploitation detail, masked channel transcript and the captured 216-host list (masked in the final octet).

A. EXECUTIVE SUMMARY

V4 · 29 OCT 2026 · BOTTOM LINE
PHP2Shell (v4) tracks Korean-speaking operators, assessed with high confidence as North Korean (DPRK) state-nexus operators of the Lazarus Group ecosystem with a dual financial and espionage mandate, exploiting two unauthenticated remote-code-execution flaws in PHP core. Operators have moved from reconnaissance into active exploitation and claim to have expanded the target set from 216 to 581 hosts. Assessed risk: Critical where internet-facing PHP remains unpatched. The 581 figure is an adversary statement; CYFIRMA independently captured the original 216-host list.

CAMPAIGN TIMELINE · 17 TO 29 OCTOBER 2026

* Adversary claim, not independently verified.

THREAT AT A GLANCE

TARGET SET CLAIMED
581 hosts, expanded from the original 216 (adversary claim)

ORIGINAL SET CAPTURED
216 host list obtained by CYFIRMA across 10 countries

CVSS v4.0
9.2 two unauthenticated RCE flaws in PHP core

CAPTURED TARGET SET · 216 HOSTS BY COUNTRY

148 Asia-Pacific 68.5%
49 North America 22.7%
19 Middle East 8.8%
96 USA and Japan combined 44.4%

WHAT IS AND IS NOT ESTABLISHED

CONFIRMED
  • Captured list. CYFIRMA obtained the original 216-host target set across 10 countries.
  • Vulnerabilities. CVE-2026-109618 and CVE-2026-109619 are unauthenticated RCE flaws in PHP core, CVSS v4.0 9.2.
  • Activity. Low-and-slow weakness checks and initial exploitation attempts are continuing against internet-facing PHP.
ASSESSED
  • Actor. North Korean (DPRK) state-nexus operators of the Lazarus Group ecosystem. High confidence, raised from moderate on the Lazarus link in Version 1.
  • Dual mandate. Observed tasking spans financial gain and espionage.
NOT ESTABLISHED
  • Expanded scope. The 581-host figure is an adversary claim, not independently verified.
  • Exploitation per host. Operator claims of successful web-shell deployment are self-reported, not confirmed per host.
  • Per-host compromise. Appearance on the list indicates targeting, not compromise.
PRIORITIES
  • Primary risk: organisations still advertising older PHP versions in the prioritised sectors should assume they remain in scope, whether or not they appear on the 216-host list.
  • Immediate priority: patch and restart every PHP worker to a fixed release, then hunt web/WAF/proxy logs back to 17 October 2026.
  • New visibility: the captured 216-host list lets organisations confirm whether their own infrastructure was named.

01. EXPLOITATION AND VULNERABILITY DETAIL

V4 · 29 OCT 2026 · TWO UNAUTHENTICATED PHP-CORE RCE FLAWS
Both flaws rely on PHP’s longjmp()-based “bailout”, which aborts a request mid-operation and can leave internal state half-built or pointing at freed memory. In worker-based deployments a follow-up request on the same worker inherits that stale state. Operators adapt public PoC code, rank it with a local AI model, lab-validate, then apply low-and-slow pacing with node rotation and burn discipline. Successful hits are followed by PHP web-shell deployment.

CVE-2026-109618 – RCE via out-of-memory corruption

  • Crafted multipart/form-data requests force the multipart parser to exhaust the PHP memory_limit.
  • When the limit is hit, PHP bails out of the allocator; some execution contexts leave request memory partially initialised.
  • Shutdown cleanup then reads or branches on that memory, producing a controllable corruption primitive.
  • A follow-up request on the same worker converts the corruption into reliable code execution. Highest success on Apache mod_php, prefork MPM.

CVE-2026-109619 – RCE via stale global state (session upload-progress)

  • Crafted multipart/form-data requests abuse PHP’s session upload-progress feature (PHP_SESSION_UPLOAD_PROGRESS).
  • A request is forced to die at a precise moment, leaving request-owned global state pointing at freed memory.
  • A follow-up request on the same worker reads the dangling pointer before initialisation (use-after-free).
  • The poisoned session data is turned into RCE or session hijacking, especially with local file inclusion. PHP 8.5’s fatal_error_backtraces is another confirmed consumer.

02. EXPECTED ATTACK PATH

V4 · 29 OCT 2026 · MAPPED TO MITRE ATT&CK

# PHASE ANTICIPATED ACTIVITY
1 Reconnaissance Passive banner/version fingerprinting; country- and sector-segmented list building; probing of multipart endpoints and session upload-progress; AI-assisted ranking of public PoCs.
2 Resource development Adaptation of public exploit code; staging; lab validation.
3 Initial access Crafted multipart/form-data POST exploiting CVE-2026-109618 or -109619 (highest success on Apache mod_php prefork).
4 Execution and persistence Command execution as the web-worker user; PHP web-shell deployment; cron and SSH-key implants.
5 Credential access and collection Harvesting of wp-config.php, .env, DB credentials and API keys; memory disclosure; OPcache file reads.
6 C2 and impact Loader fetch-and-run; outbound C2; cryptomining, ransomware precursors, lateral movement and data exfiltration.

03. SUSPECTED SOURCE INFRASTRUCTURE

V4 · 29 OCT 2026 · SCAN AND STAGING ADDRESSES · BLOCK / MONITOR
Suspected source addresses associated with adversarial activity (PHP web-shell tooling and upload-progress session-poisoning). Treat as BLOCK / MONITOR.

# SOURCE ADDRESS HANDLING
1 152.237.230.31 BLOCK / MONITOR
2 117.83.155.42 BLOCK / MONITOR
3 152.237.230.36 BLOCK / MONITOR
4 85.11.190.112 BLOCK / MONITOR
5 138.199.43.94 BLOCK / MONITOR
6 23.234.113.169 BLOCK / MONITOR
7 118.186.18.243 BLOCK / MONITOR
8 2.59.133.151 BLOCK / MONITOR
9 141.98.255.246 BLOCK / MONITOR
10 156.225.28.97 BLOCK / MONITOR
11 178.249.214.6 BLOCK / MONITOR
12 64.11.92.102 BLOCK / MONITOR
13 161.97.178.84 BLOCK / MONITOR
14 161.97.179.152 BLOCK / MONITOR
15 47.250.155.133 BLOCK / MONITOR
16 186.22.19.172 BLOCK / MONITOR
17 119.59.101.74 BLOCK / MONITOR
18 185.177.72.45 BLOCK / MONITOR
19 32.236.50.30 BLOCK / MONITOR
20 32.236.55.80 BLOCK / MONITOR
21 223.178.86.187 BLOCK / MONITOR
22 112.245.227.143 BLOCK / MONITOR
23 95.179.220.151 BLOCK / MONITOR
24 79.193.197.168 BLOCK / MONITOR

04. ADVERSARY CONVERSATION INTELLIGENCE

V4 · 29 OCT 2026 · 25 TO 29 OCTOBER · CHATS MASKED

Masked channel screenshots
Screenshots of the 25 to 29 October 2026 exchange, reproduced with operator handles, channel identifiers, the node/IP list and most message content masked. Post numbers and timestamps are retained; the masked transcript below carries the readable content. Where post numbers or timestamps shown in the screenshots differ from the transcript, the transcript reflects CYFIRMA’s original capture.

Channel thread (forum view)

FIGURE 4.1 Closed channel thread, 25 to 29 October 2026. Handles, channel identifiers, node/IP list and most message content masked.

Direct message view

FIGURE 4.2 Direct-message view of the same exchange, 25 to 29 October 2026. Masked as in Figure 4.1.

Masked transcript
Masked English translation of the closed-channel exchange, 25–29 October 2026. The two participants are shown as Operator 1 and Operator 2; the single node/IP list posted in the channel is withheld.

Operator 1 25 Oct · 14:20
First pass results on the 216 are in. The multipart OOM path is landing cleanly on the mod_php prefork boxes; session-upload progress on the FPM ones is slower but usable. Web shells are opening.

Operator 2 25 Oct · 14:35
Confirmed. I am rotating the nodes slowly and dropped two that started getting filtered. I have updated the sheet.

Operator 1 25 Oct · 15:10
Good. Can you send me the original 216 list again? I want to cross-check the ones we already touched.

Operator 2 25 Oct · 15:18
Sure. Sharing the previous 216 target list now (attached file).

Operator 1 25 Oct · 15:25
Got it. Looking at the country split, plenty of infrastructure providers, telco, government and bank ranges are still in there.

Operator 2 25 Oct · 16:40
The nodes I am currently using for the 216 and for the new scanning are: (node/IP list withheld). Rotating through them so nothing stays hot for too long.

Operator 1 26 Oct · 09:10
Expand the list. Pull in the next tier that still banners old PHP. We have now 581. Government and banks first, then logistics and trading platforms.

Operator 2 26 Oct · 11:45
Understood. Spreadsheet is updated. I am using the public PoC ranking from the local model and lab-validated both paths again. Same node list covers the old 216 and the new additions.

Operator 1 26 Oct · 18:20
How are the shells looking on the ones we already hit? Any that need a second pass with the session-poisoning sequence?

Operator 2 26 Oct · 18:45
A few on FPM needed the follow-up request on the same worker. OOM path was cleaner on prefork. Most of the high-confidence 216 already have something planted.

Operator 1 27 Oct · 16:00
We need financial outcome and anything that leads to financial, trading or wallet material. Espionage on the government ones is the parallel track. Once we have a shell, go lateral: config files, .env, DB creds.

Operator 2 27 Oct · 17:15
Noted. I am pulling configs where the shell sticks. Some of the South Korean, Japanese, USA, Thailand, Indonesia and India ranges look promising.

Operator 2 28 Oct · 08:30
More nodes online. Session poisoning plus a follow-up on the same worker is the reliable sequence for 109619; 109618 is cleaner on prefork. Burned addresses are out.

Operator 1 28 Oct · 10:05
Keep the rotation slow. If any start attracting attention, drop them immediately.

Operator 2 28 Oct · 10:20
Understood. Current batch is holding. I will mark anything that shows filtering and pull it.

Operator 1 29 Oct · 13:00
Target list is at 581. Original 216 still the highest confidence. Continue the paced checks and the shells.

Operator 2 29 Oct · 13:15
Agreed. Full results and the refined shortlist are being updated in the sheet. The original 216 set is still the priority.

05. RECOMMENDED ACTIONS

V4 · 29 OCT 2026 · PATCH · BLOCK · PRESERVE · HUNT · ISOLATE

  • Patch and restart every PHP worker immediately (8.5.12+, 8.4.27+, 8.3.36+, 8.2.35+ or a verified vendor backport). A reload that leaves old workers alive stays vulnerable.
  • Block or closely monitor the suspected source addresses above, plus all previously published scan-node and staging addresses.
  • Hunt web/WAF/proxy logs back to 17 October 2026 for multipart anomalies, unexpected PHP files, worker crashes and PHP-spawned shells.
  • Preserve volatile evidence before patching any suspect host (a restart destroys the CVE-2026-109619 state).
  • Isolate unpatchable internet-facing PHP (Apache mod_php first) and apply per-CVE temporary controls.
  • Treat captured-list hosts as confirmed targets. Organisations in the 216-host list should execute the above with highest urgency.

06. CAPTURED TARGET SET

V4 · 29 OCT 2026 · ORIGINAL 216-HOST LIST · ADDRESSES MASKED
The original 216-host target list, by country. Each address is masked in its final octet so organisations can check their own /24 ranges without re-identifying an individual host.

COUNTRY HOST COUNT
South Korea 30
Japan 47
Thailand 16
Indonesia 10
Saudi Arabia 5
Australia 10
USA 49
Singapore 4
UAE 14
India 31
Total 216

South Korea  (30 hosts)

1.226.82.xxx 1.234.2.xxx 1.234.20.xxx 1.234.80.xxx
1.234.82.xxx 112.144.165.xxx 116.42.122.xxx 118.219.233.xxx
118.42.13.xxx 119.206.205.xxx 121.131.194.xxx 121.160.153.xxx
14.6.17.xxx 175.118.124.xxx 175.126.111.xxx 175.126.176.xxx
175.198.162.xxx 175.215.123.xxx 183.97.195.xxx 211.110.1.xxx
211.110.226.xxx 211.206.125.xxx 211.43.15.xxx 211.49.99.xxx
218.38.12.xxx 218.48.72.xxx 219.240.39.xxx 221.153.188.xxx
222.239.78.xxx 59.5.26.xxx    

Japan  (47 hosts)

118.27.111.xxx 202.238.241.xxx 125.30.84.xxx 150.31.182.xxx
202.238.242.xxx 126.59.129.xxx 218.183.52.xxx 60.67.104.xxx
202.228.201.xxx 202.228.201.xxx 210.140.191.xxx 210.140.191.xxx
210.152.10.xxx 210.152.120.xxx 153.150.33.xxx 153.121.45.xxx
153.121.52.xxx 153.121.77.xxx 153.121.77.xxx 160.16.145.xxx
163.43.209.xxx 163.43.225.xxx 163.43.29.xxx 111.87.226.xxx
113.36.110.xxx 113.37.207.xxx 121.111.155.xxx 122.219.47.xxx
125.50.174.xxx 125.50.174.xxx 153.145.177.xxx 153.150.58.xxx
153.156.0.xxx 153.160.56.xxx 175.134.8.xxx 180.42.71.xxx
203.180.251.xxx 210.160.212.xxx 61.117.144.xxx 110.67.136.xxx
122.131.18.xxx 124.219.164.xxx 146.160.242.xxx 182.171.73.xxx
202.223.49.xxx 223.135.153.xxx 58.70.228.xxx  

Thailand  (16 hosts)

110.164.157.xxx 110.164.166.xxx 110.170.129.xxx 110.170.129.xxx
110.170.129.xxx 110.170.78.xxx 119.46.118.xxx 119.46.201.xxx
119.76.191.xxx 125.26.107.xxx 125.27.182.xxx 183.88.214.xxx
183.88.218.xxx 183.88.218.xxx 183.89.208.xxx 61.91.110.xxx

Indonesia  (10 hosts)

180.250.72.xxx 182.10.106.xxx 182.9.237.xxx 36.66.7.xxx
36.88.234.xxx 36.88.49.xxx 36.94.134.xxx 36.94.2.xxx
36.94.72.xxx 36.95.119.xxx    

Saudi Arabia  (5 hosts)

178.81.215.xxx 37.216.224.xxx 37.224.13.xxx 37.76.239.xxx
46.251.150.xxx      

Australia  (10 hosts)

101.174.30.xxx 110.175.187.xxx 110.175.195.xxx 120.151.47.xxx
124.187.52.xxx 14.203.95.xxx 203.221.43.xxx 203.49.157.xxx
49.176.218.xxx 61.68.82.xxx    

USA  (49 hosts)

100.11.100.xxx 100.38.170.xxx 104.15.231.xxx 104.179.196.xxx
104.63.236.xxx 108.236.242.xxx 108.73.139.xxx 108.85.100.xxx
12.203.23.xxx 12.6.196.xxx 173.12.125.xxx 173.59.31.xxx
174.50.103.xxx 174.59.19.xxx 209.64.57.xxx 24.4.18.xxx
24.5.195.xxx 45.17.108.xxx 45.29.56.xxx 66.73.190.xxx
67.187.209.xxx 67.190.141.xxx 68.94.187.xxx 69.213.238.xxx
71.105.11.xxx 71.183.10.xxx 71.185.221.xxx 71.191.40.xxx
71.192.1.xxx 71.200.14.xxx 72.69.211.xxx 73.135.29.xxx
73.169.193.xxx 73.199.122.xxx 73.213.218.xxx 73.38.11.xxx
73.98.132.xxx 74.94.106.xxx 75.50.42.xxx 75.52.96.xxx
75.66.63.xxx 96.80.59.xxx 96.95.43.xxx 98.114.8.xxx
98.115.153.xxx 99.147.222.xxx 99.149.104.xxx 99.32.85.xxx
99.65.57.xxx      

Singapore  (4 hosts)

119.234.136.xxx 203.126.35.xxx 203.127.45.xxx 58.185.17.xxx

UAE  (14 hosts)

151.253.188.xxx 195.200.17.xxx 195.229.199.xxx 195.229.199.xxx
195.26.226.xxx 46.151.25.xxx 5.195.25.xxx 87.199.198.xxx
87.199.207.xxx 89.110.112.xxx 89.124.65.xxx 89.124.97.xxx
94.200.121.xxx 94.200.29.xxx    

India  (31 hosts)

110.225.252.xxx 115.240.52.xxx 115.240.65.xxx 115.241.97.xxx
115.243.103.xxx 115.245.167.xxx 115.245.222.xxx 115.246.89.xxx
117.216.139.xxx 117.239.177.xxx 117.239.231.xxx 117.239.31.xxx
117.240.136.xxx 117.248.201.xxx 117.250.69.xxx 117.254.196.xxx
122.166.179.xxx 122.166.253.xxx 122.176.109.xxx 122.176.133.xxx
122.176.21.xxx 122.176.46.xxx 122.176.46.xxx 122.179.155.xxx
47.247.242.xxx 47.29.139.xxx 59.92.113.xxx 59.92.53.xxx
59.92.53.xxx 59.93.129.xxx 59.97.238.xxx  

SUPERSEDED BY A LATER VERSION

VERSION 3 : 24 October 2026

Operators reported a completed 216-host target set and 21 compromised scan-node IPs, distinct from the earlier staging addresses. Channel update and scanning tradecraft.

A. UPDATE SUMMARY

V3 · 24 OCT 2026 · CHANNEL ACTIVITY

BOTTOM LINE
On 24 October 2026 (~01:47–02:22) the operators reported completion of an initial target set: 216 hosts still unpatched or only partially mitigated for PHP2Shell. They stated that active weakness checks run from a separate set of 21 compromised nodes, with low-volume, paced scanning and burn discipline. Roughly a third of the set had already been touched. Block or closely monitor the 21 scan-node addresses, in addition to the 17 listed in Version 2.

01. TARGET SET AND SCANNING TRADECRAFT

V3 · 24 OCT 2026 · 216-HOST SET · NODE ROTATION

ATTRIBUTE DETAIL
Hosts identified 216 hosts that still look unpatched or partially exposed to PHP2Shell; first batch reported ready ~01:47 on 24 Oct 2026.
Geographic coverage Stated priorities: USA, Japan, Thailand, Indonesia, South Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia and the EU.
Sector mix Government, financial institutions, logistics, airports/aviation, manufacturing and online transaction platforms.
Selection criteria Hosts bannering the fixed versions, or behind heavy filtering, were dropped. The remaining 216 still advertise older PHP.
Scan progress About a third of the 216 (~72) had been touched by ~02:10; first full pass and a refined shortlist due later on 24 Oct.
Next step From the highest-confidence shortlist, the operators will decide which public approaches are worth adapting.

Scanning tradecraft

TRADECRAFT OBSERVATION
Infrastructure separation New scan nodes are separate from the earlier preparation addresses (operator-confirmed ~02:04).
Low-and-slow pacing Volume kept low and paced so not every target is lit up at once; no broad noisy sweeps.
Node rotation Operators rotate through the node list, logging which addresses respond with the expected indicators.
Burn discipline Nodes showing filtering or rate-limiting are marked, pulled from the active set and not reused.

02. SUSPECTED SCAN-NODE INFRASTRUCTURE

V3 · 24 OCT 2026 · 21 ADDRESSES · BLOCK / MONITOR
21 suspected source addresses the operators named as the nodes running their PHP weakness checks, observed performing PHP web-shell tooling and upload-progress session poisoning. Described as compromised, so some may belong to victim organisations; block at the perimeter and hunt for prior contact. These supplement the 17 in Version 2.

# SOURCE ADDRESS ACTIVITY HANDLING
1 142.93.155.162 Web-shell tooling / session poisoning BLOCK / MONITOR
2 134.122.38.73 Web-shell tooling / session poisoning BLOCK / MONITOR
3 5.255.114.109 Web-shell tooling / session poisoning BLOCK / MONITOR
4 165.22.232.198 Web-shell tooling / session poisoning BLOCK / MONITOR
5 159.223.59.200 Web-shell tooling / session poisoning BLOCK / MONITOR
6 192.177.131.13 Web-shell tooling / session poisoning BLOCK / MONITOR
7 94.154.42.149 Web-shell tooling / session poisoning BLOCK / MONITOR
8 173.249.16.178 Web-shell tooling / session poisoning BLOCK / MONITOR
9 170.64.224.137 Web-shell tooling / session poisoning BLOCK / MONITOR
10 170.64.226.40 Web-shell tooling / session poisoning BLOCK / MONITOR
11 45.148.10.80 Web-shell tooling / session poisoning BLOCK / MONITOR
12 152.237.230.29 Web-shell tooling / session poisoning BLOCK / MONITOR
13 146.70.194.93 Web-shell tooling / session poisoning BLOCK / MONITOR
14 185.157.109.60 Web-shell tooling / session poisoning BLOCK / MONITOR
15 143.246.213.138 Web-shell tooling / session poisoning BLOCK / MONITOR
16 144.91.70.51 Web-shell tooling / session poisoning BLOCK / MONITOR
17 217.60.196.124 Web-shell tooling / session poisoning BLOCK / MONITOR
18 151.253.243.219 Web-shell tooling / session poisoning BLOCK / MONITOR
19 23.106.131.214 Web-shell tooling / session poisoning BLOCK / MONITOR
20 173.249.16.192 Web-shell tooling / session poisoning BLOCK / MONITOR
21 45.148.10.201 Web-shell tooling / session poisoning BLOCK / MONITOR

03. ADVERSARY CONVERSATION INTELLIGENCE

V3 · 24 OCT 2026 · 24 OCTOBER · CHATS MASKED

Masked channel screenshots
Screenshots of the closed I2P forum thread and the associated direct-message exchange, 24 October 2026, original Korean text. Operator handles, the channel name, the I2P destination, all IP addresses and most message content are masked; post numbers and timestamps are retained. The scan-node addresses named in the exchange are listed in Section 02. Where post numbers or timestamps shown in the screenshots differ from the transcript, the transcript reflects CYFIRMA’s original capture.

Channel thread (forum view)

FIGURE 3.1 Closed I2P forum thread, 24 October 2026. Handles, channel name, I2P destination, IP addresses and most message content masked.

Direct message view

FIGURE 3.2 Direct-message exchange between Operator 1 and Operator 2, 24 October 2026, ~01:47 to 02:22. Masked as in Figure 3.1.

Masked transcript
Masked English translation of the closed-channel exchange, 24 October 2026 (~01:47–02:22). The participants are shown as Operator 1 and Operator 2; the scan-node list named in the channel is withheld (see Section 02).

Operator 1 ~01:47
The first batch is ready. We have 216 hosts that still look unpatched or partially exposed across the priority regions. Mix of government, financial, logistics, airports, manufacturing and online transaction platforms. The spreadsheet is at the collection point.

Operator 2 ~01:50
Good.

Operator 1 ~01:53
Yes. Anything bannered the fixed versions or sat behind heavy filtering was dropped. Remaining 216 are the ones that still advertise older PHP. Sector and country tags are already in the sheet.

Operator 2 ~01:57
Understood. On the scanning side, I have been using the additional compromised infrastructure we picked up. These are the nodes currently running the PHP weakness checks: (scan-node list withheld; see Section 02).

Operator 1 ~02:01
Those are separate from the earlier staging addresses, correct?

Operator 2 ~02:04
Correct. These new ones are the ones actually running the checks. Volume is still low and paced so we do not light everything up at once. No broad noisy sweeps.

Operator 1 ~02:07
Good. How many of the 216 have already been touched by the current scan nodes?

Operator 2 ~02:10
Roughly a third so far. I am rotating through the node list and logging which addresses respond with the expected indicators. Results are going back into the same spreadsheet under a separate column.

Operator 1 ~02:13
Keep the rotation slow. If any of those nodes start getting blocked or attract attention, drop them immediately and move to the next. Do not reuse burned addresses.

Operator 2 ~02:16
Understood. I will mark any node that shows signs of filtering or rate-limiting and pull it from the active set. So far the current batch is holding.

Operator 1 ~02:19
Once the first pass across all 216 is finished, send the shortlist of the highest-confidence ones. We will decide from there which public approaches are worth adapting.

Operator 2 ~02:22
Agreed. I should have the full first-pass results and the refined shortlist ready later today.

04. RECOMMENDED ACTIONS

V3 · 24 OCT 2026 · BLOCK · HUNT · PATCH

PRIORITY ACTION
P1 · NOW Block or closely monitor traffic from the 21 addresses in Section 02 at the perimeter and host level, in addition to the 17 published in Version 2.
P1 · NOW Hunt web/WAF/proxy logs for prior contact with the listed addresses, and review web roots for unexpected PHP files. Review extended time windows, as the scanning is low-volume and paced.
P2 · TODAY Prioritise patching of internet-facing hosts that still advertise older PHP; the operators removed hosts bannering the fixed versions from their target set.
CONTINUING ACTIONS
The recommendations in Versions 1 and 2 remain in force — patch to 8.5.12+ / 8.4.27+ / 8.3.36+ / 8.2.35+, restart all workers, isolate unpatchable PHP, hunt from 17 October 2026, and block the 17 addresses in Version 2. This version adds the 21 addresses above.

SUPERSEDED BY A LATER VERSION

VERSION 2 : 23 October 2026

17 suspected source IPs observed in the preceding 8 hours performing PHP web-shell tooling and upload-progress session poisoning. Treat as additional hunting and blocking indicators.

A. UPDATE SUMMARY

V2 · 23 OCT 2026 · NEW SOURCE INFRASTRUCTURE

BOTTOM LINE
CYFIRMA identified 17 suspected source IP addresses that, within the preceding 8 hours, were performing PHP web-shell tooling and upload-progress session poisoning. The activity is consistent with the exploitation and post-exploitation behaviour anticipated in Version 1. Block or closely monitor the 17 addresses at the perimeter and host level; the Version 1 actions remain in force.

01. OBSERVED TECHNIQUES AND SOURCE IPS

V2 · 23 OCT 2026 · 17 ADDRESSES · BLOCK / MONITOR

TECHNIQUE DESCRIPTION
PHP web shell tooling Deployment or use of PHP-based web shells for remote code execution, persistence and post-exploitation on compromised web servers.
Upload progress session poisoning Exploitation of PHP’s session upload-progress feature via crafted multipart/form-data to poison session data, enabling RCE or session hijacking under certain configurations.

17 suspected source addresses identified in the last 8 hours. Several may be shared or anonymising infrastructure; block at the perimeter and hunt in logs for prior contact.

# SOURCE ADDRESS ACTIVITY HANDLING
1 102.207.250.188 Web-shell tooling / session poisoning BLOCK / MONITOR
2 94.154.43.185 Web-shell tooling / session poisoning BLOCK / MONITOR
3 75.119.143.189 Web-shell tooling / session poisoning BLOCK / MONITOR
4 117.203.73.63 Web-shell tooling / session poisoning BLOCK / MONITOR
5 146.190.107.103 Web-shell tooling / session poisoning BLOCK / MONITOR
6 95.217.164.124 Web-shell tooling / session poisoning BLOCK / MONITOR
7 124.122.142.142 Web-shell tooling / session poisoning BLOCK / MONITOR
8 188.80.228.122 Web-shell tooling / session poisoning BLOCK / MONITOR
9 134.209.181.133 Web-shell tooling / session poisoning BLOCK / MONITOR
10 134.209.252.157 Web-shell tooling / session poisoning BLOCK / MONITOR
11 119.63.72.54 Web-shell tooling / session poisoning BLOCK / MONITOR
12 138.68.161.170 Web-shell tooling / session poisoning BLOCK / MONITOR
13 95.216.5.90 Web-shell tooling / session poisoning BLOCK / MONITOR
14 103.21.161.105 Web-shell tooling / session poisoning BLOCK / MONITOR
15 115.96.27.126 Web-shell tooling / session poisoning BLOCK / MONITOR
16 185.207.232.121 Web-shell tooling / session poisoning BLOCK / MONITOR
17 78.47.85.99 Web-shell tooling / session poisoning BLOCK / MONITOR

02. RECOMMENDED ACTIONS

V2 · 23 OCT 2026 · BLOCK

PRIORITY ACTION
P1 · NOW Block or closely monitor traffic from the 17 listed addresses at the perimeter and host level.
CONTINUING ACTIONS
The Version 1 recommendations (22 October 2026) remain in force — patch to 8.5.12+ / 8.4.27+ / 8.3.36+ / 8.2.35+, restart all workers, isolate unpatchable internet-facing PHP, and hunt from 17 October 2026. This update adds the IP-based control above.

SUPERSEDED BY A LATER VERSION

VERSION 1 : 22 October 2026

Original pre-attack advisory. Lazarus-ecosystem attribution, PHP2Shell vulnerability detail, expected attack path, indicators of compromise, detection content and impact assessment.

A. EXECUTIVE SUMMARY

V1 · 22 OCT 2026 · PRE-ATTACK NOTIFICATION

BOTTOM LINE
CYFIRMA assesses with HIGH confidence that a Korean-speaking operator, suspected to be a North Korean state-nexus actor affiliated with the Lazarus Group ecosystem (MODERATE confidence), is actively staging a global offensive campaign against internet-facing PHP vulnerable to PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Treat every internet-facing PHP host below 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 as exposed. Patch immediately and restart all workers; hunt back to 17 October 2026 (earliest known exploitation).

The campaign was first surfaced through CYFIRMA closed-source collection on 22 October 2026 (~11:00 JST), when actors coordinating via a closed I2P channel discussed global reconnaissance and attack planning against all web-accessible assets carrying the two PHP flaws. Tasking explicitly prioritised national government agencies, banks and financial institutions, manufacturing, logistics, shipping, airports and aviation, online transaction platforms, trading companies and construction firms across the United States, Japan, Thailand, Indonesia, Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia and the European Union. Fifteen pieces of campaign infrastructure were shared in-channel for staging and launch. No launch date was stated; the first filtered target list was expected by 25 October 2026.

THREAT AT A GLANCE

ASSESSED ACTOR
DPRK state-nexus operator; suspected Lazarus (APT38 / Hidden Cobra / ZINC) affiliation

IMMINENCE INDEX
78/100 active scanning and early in-the-wild exploitation; launch readiness discussed

CVSS v4.0
9.2 CVE-2026-109618 and CVE-2026-109619 — unauthenticated RCE in PHP core

IMMINENCE INDEX: 78 / 100
Targets identified (all internet-facing PHP); public exploit tooling circulating; active scanning and early in-the-wild exploitation observed globally; DPRK channel discussing launch readiness and sector prioritisation. The absence of confirmed mass successful compromise attributable to this specific actor keeps the index below 90.

01. KEY JUDGMENTS

V1 · 22 OCT 2026 · ASSESSMENTS AND CONFIDENCE

  • A Korean-speaking, suspected North Korean state-nexus actor is in the reconnaissance-to-weaponisation phase against the global PHP estate. Monitoring confirms explicit intent to mass-identify web-accessible assets carrying the two CVEs, de-conflict them by country and sector, and adapt public exploit code rather than develop novel primitives. — HIGH CONFIDENCE (intent, activity) · MODERATE (Lazarus link)
  • The most likely initial access vector is exploitation of public-facing PHP via crafted multipart/form-data requests abusing the session upload-progress path (-109619) or out-of-memory corruption (-109618), with highest success against Apache mod_php in its default prefork configuration. — MODERATE CONFIDENCE
  • Timing is opportunistic and tied to exploit readiness rather than an external trigger. The operation fuses financial motivation with state-nexus espionage objectives, consistent with the Lazarus ecosystem’s dual mandate. — MODERATE CONFIDENCE
  • AI-assisted triage is being used to rank public proof-of-concept repositories and accelerate reconnaissance, compressing the gap between disclosure and reliable weaponisation. Measure patch and mitigation timelines in hours, not days. — MODERATE CONFIDENCE

02. ADVERSARY PROFILE — LAZARUS ECOSYSTEM

V1 · 22 OCT 2026 · DESIGNATION · CLUSTERS · ATTRIBUTION

ATTRIBUTE DETAIL
Designation Lazarus Group ecosystem; Korean-speaking operator, small team.
Attribution State-nexus · North Korea (DPRK). Reconnaissance General Bureau (RGB) / Bureau 121 and subordinate offensive cyber units.
Known aliases APT38, Hidden Cobra, ZINC, Diamond Sleet. Related clusters: BlueNoroff, Andariel, Kimsuky.
Attribution confidence MODERATE — rests on behavioural and linguistic indicators rather than definitive infrastructure or malware-family overlap.
Operational style Disciplined, access-focused. Harvests public PoCs, ranks them with AI, lab-validates before use, avoids noisy scanning.

The Lazarus ecosystem at a glance

CLUSTER (ALIASES) PRIMARY MANDATE RELEVANCE TO PHP2SHELL
Lazarus Group (APT38, Hidden Cobra, ZINC, Diamond Sleet) Financial theft at scale; destructive operations; espionage Documented use of compromised web servers and web shells for C2 and staging; opportunistic mass-RCE weaponisation.
APT38 / BlueNoroff (Sapphire Sleet, Stardust Chollima) Financial institutions, SWIFT networks, cryptocurrency and DeFi theft BFSI and crypto/trading platforms are top-tier targets in the intercepted tasking.
Andariel (Silent Chollima, Onyx Sleet, DarkSeoul) Espionage against defence, aerospace, healthcare; opportunistic ransomware Watering-hole and web-server compromise tradecraft; ransomware precursor risk.
Kimsuky (Velvet Chollima, Emerald Sleet, APT43) Strategic intelligence collection; spear-phishing; credential theft May consume web-server footholds for collection and onward credential harvesting.

Attribution assessment
SUPPORTS DPRK / LAZARUS

  • Korean-language operational tasking in a closed, OPSEC-conscious I2P channel.
  • Sector prioritisation (government + BFSI first) mirrors the Lazarus dual mandate.
  • Historical Lazarus use of PHP/web-shell tradecraft and compromised web C2.
  • Disciplined, access-focused tradecraft (AI-assisted PoC triage, lab validation).

UNCERTAINTIES

  • Language alone is not attribution; could reflect a Korean-speaking criminal crew.
  • Government and BFSI are high-value to many financially-motivated actors.
  • No confirmed malware-family or infrastructure overlap with a named Lazarus cluster yet.

Net assessment: MODERATE confidence in Lazarus-ecosystem affiliation. Confidence would rise on infrastructure or tooling overlap with a named cluster, a launch statement, or confirmed compromises; and fall if collection indicates an unaffiliated Korean-speaking criminal group.

03. CHANNEL AND VERIFIED TARGETS

V1 · 22 OCT 2026 · COLLECTION SOURCE · TARGET TIERS

ATTRIBUTE DETAIL
Platform I2P (Invisible Internet Project), closed channel.
Channel 2026년 6월 민준 (June 2026 Minjun).
Observed handles Two operators, active since March 2026 (handles withheld; anonymised as Operator 1 and Operator 2 in the masked transcript).
Activity Closed sharing of target lists, exploit-hosting infrastructure, tasking and prioritisation; discussion of global reconnaissance against web-accessible PHP carrying the two CVEs.

Target verification — prioritised targeting from intercepted tasking

PRIORITY SECTORS GEOGRAPHIES
Tier 1 National government agencies; banks and financial institutions US, Japan, Korea, UAE, EU, Thailand, Indonesia, Saudi Arabia
Tier 2 Manufacturing; logistics, shipping and ports; airports and aviation Thailand, Indonesia, Australia, Taiwan, India, Japan, UAE
Tier 3 Online transaction / trading platforms; trading companies; construction Singapore, UAE, Saudi Arabia, and broader EU

Assets in scope: all internet-facing PHP runtimes — PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed (LSAPI), and embedded PHP in appliances and hosting control panels (cPanel, Plesk). Highest risk: unpatched Apache mod_php. No specific hosts were named in-channel at this stage.

Masked channel screenshots
Screenshots of the closed I2P forum thread and the associated direct-message exchange, 22 October 2026, ~11:00 to 11:31 JST. Operator handles, channel identifiers, staging addresses and most message content are masked. Where post numbers or timestamps shown in the screenshots differ from the transcript, the transcript reflects CYFIRMA’s original capture.

Channel thread (forum view)

FIGURE 1.1 I2P forum thread on the PHP runtime issue leak (20 October) and reconnaissance plan, 22 October 2026, ~11:00 to 11:31 JST.

Direct message view

FIGURE 1.2 Direct-message exchange between Operator 1 and Operator 2, 22 October 2026: target countries, staging addresses (masked) and AI-assisted sorting.

Masked transcript
Masked English translation of the closed-channel exchange, 22 October 2026 (~11:00–11:31 JST). The participants are shown as Operator 1 and Operator 2; staging and collection addresses referenced in the channel are withheld.

Operator 1 ~11:00
We need to move on the PHP runtime issues that leaked on the 20th. Patches are out but a lot of internet-facing systems will still be slow. Focus first on national agencies, banks and financial institutions, manufacturing, logistics, shipping, airports and aviation, online transaction platforms, trading companies and construction firms. Priority regions: USA, Japan, Thailand, Indonesia, Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia and the EU.

Operator 2 ~11:04
Understood. I will start passive collection of public banners and version strings for anything advertising PHP. We stay off anything that looks already heavily monitored.

Operator 1 ~11:07
Good. Separate the list by country and sector so we can prioritise government and financial sites first, then logistics, ports, airports and manufacturing. Use the staging and collection points we already shared.

Operator 2 ~11:12
I will treat those addresses as intermediaries for hosting the target lists. I will not perform active scans. I am also pulling the public GitHub notes and researcher write-ups to see which approaches look more reliable before we invest time.

Operator 1 ~11:15
Use public information only. Do not invent new primitives. Check the differences between the out-of-memory path and the stale-state path. We want something that works against common Apache and FPM setups without needing local access.

Operator 2 ~11:19
I will feed the public technical descriptions into our local AI for reconnaissance and to rank which public repositories claim the right mechanism versus the incomplete or conditional ones. Then I will manually verify the promising ones in a controlled lab before any wider use.

Operator 1 ~11:23
AI is only for speed on sorting and validation of open material. Final decisions stay with us. Once we have a shortlist of likely-vulnerable hosts we expand carefully. No broad noisy scanning that lights up every sensor at once.

Operator 2 ~11:27
Agreed. I will produce the first country-and-sector target spreadsheet by 25 October. Collection points stay on the infrastructure we already discussed. I will also flag any hosts that appear to have already applied the 21 October patches.

Operator 1 ~11:31
Perfect. Keep everything inside the channel. Next update when the first filtered list is ready and when we have a clearer view of which public approaches are worth adapting.

04. VULNERABILITY — PHP2SHELL

V1 · 22 OCT 2026 · CVE DETAIL · EXPOSURE · VERSIONS
Both vulnerabilities share one root cause: PHP’s longjmp()-based “bailout” aborts a request mid-operation and leaves internal state half-built or pointing at freed memory. In worker-based deployments a subsequent request handled by the same worker inherits that stale state.

CVE-2026-109618 — RCE via out-of-memory corruption

  • When a request exceeds memory_limit, PHP bails out of the allocator; some execution contexts leave request memory partially initialised, and shutdown cleanup then reads or branches on it.
  • The attacker controls when memory is exhausted through the multipart parser: a body with no usable declared length, many headers in one part, empty file controls that evade upload limits, or deeply nested field names.
  • Confirmed full unauthenticated RCE on Apache mod_php with default settings and prefork. Reported by Calif, Wiz, OpenAI and Quarkslab. Advisory: GHSA-w8hw-w9fx-j79w.

CVE-2026-109619 — RCE via stale global state

  • A request that dies at the wrong moment (fatal error, timeout or OOM) leaves request-owned global state pointing at freed memory; a later request on the same worker reads it before initialisation (use-after-free).
  • Confirmed consumers: session upload progress (PHP_SESSION_UPLOAD_PROGRESS) and PHP 8.5’s fatal_error_backtraces. Validated against both mod_php and PHP-FPM. Advisory: GHSA-6wmf-4rv5-p3rp.

Exposure by deployment (SAPI)

SAPI CVE-2026-109618 (OOM) CVE-2026-109619 (STALE STATE)
Apache mod_php Confirmed, full unauth RCE, default limits, prefork Confirmed
PHP-FPM Susceptible per source analysis; no full exploit shown Upload-progress path validated
FrankenPHP Likely (similar to mod_php) Not immune; no default consumer found
LiteSpeed (LSAPI) Likely, unvalidated Conditional
php-cgi At risk per PHP At risk per PHP

Affected and fixed versions

BRANCH STATUS FIX
8.5 Supported 8.5.12
8.4 Supported 8.4.27
8.3 Security-only 8.3.36
8.2 Security-only 8.2.35
8.1, 8.0, 7.4 End of life Minimal source backports only; distribution / LTS vendor builds (e.g. cPanel EasyApache 4, CloudLinux alt-php, TuxCare, Plesk); confirm branch coverage with the vendor
7.3 and older, 5.4+ End of life No fix; migrate or isolate
EXPLOITABILITY NOTE
Triggering the bug is easy; reliable code execution is not. The attacker must land a follow-up request on the same worker and shape heap data into the freed space, otherwise the worker crashes or responds normally. VulnCheck (22 October, 19:00 ET) reports RCE on x86-64 with ASLR enabled against PHP 8.4.10 to 8.4.26; its memory leak works on ARM64 but RCE is not yet functional there; at least one public PoC bypassed ASLR on x86-64 for a single version (8.4.26). Non-RCE outcomes already demonstrated: worker crash (DoS), arbitrary file read via OPcache, and ~67 KB process-memory disclosure.

05. EXPECTED ATTACK PATH

V1 · 22 OCT 2026 · MAPPED TO MITRE ATT&CK

PHASE ANTICIPATED ACTIVITY ATT&CK
Reconnaissance Passive banner/version fingerprinting; country- and sector-segmented list building; probing of multipart endpoints and session upload-progress; AI-assisted ranking of public PoCs. T1595.002 · T1590.005
Resource Development Acquisition/adaptation of public PHP2Shell exploit code; staging on campaign infrastructure; lab validation. T1588.005 · T1608.001 · T1583.004
Initial Access Exploitation of CVE-2026-109618 / -109619 via crafted multipart/form-data for unauthenticated RCE; highest success on Apache mod_php. T1190
Execution & Persistence Command execution as web-worker user; PHP/ASP web-shell deployment in web roots; cron and SSH-key implants; abandoned-config persistence. T1059.004 · T1505.003 · T1053.003 · T1098.004
Credential Access & Collection Harvesting of wp-config.php, .env, DB credentials and API keys; ~67 KB memory disclosure via PHPSESSID; config/file reads via OPcache. T1552.001 · T1005
C2 & Impact Loader fetch-and-run from staging host (Mirai convention); outbound C2; cryptomining, ransomware, lateral movement, data exfiltration. T1105 · T1210 · T1041 · T1496 · T1486

06. INDICATORS OF COMPROMISE

V1 · 22 OCT 2026 · INFRASTRUCTURE · C2 · HASHES · BEHAVIOUR
From intercepted conversation and corroborating open-source telemetry; deploy to perimeter, EDR and DNS controls. Campaign-infrastructure addresses are shared/anonymisation infrastructure — monitor and hunt rather than blind-block. Entry 16 in table A appears once, only in the direct-message exchange, and may be an actor typo of entry 4; included as a precaution.

A. Campaign infrastructure (captured from adversary conversation)

# IPV4 PRIORITY
1 146.70.114.180 MONITOR & HUNT
2 146.70.114.182 MONITOR & HUNT
3 147.175.149.67 MONITOR & HUNT
4 147.78.168.57 MONITOR & HUNT
5 109.56.219.150 MONITOR & HUNT
6 158.173.75.178 MONITOR & HUNT
7 185.203.18.54 MONITOR & HUNT
8 185.235.212.105 MONITOR & HUNT
9 103.77.210.80 MONITOR & HUNT
10 128.90.176.13 MONITOR & HUNT
11 138.199.34.201 MONITOR & HUNT
12 145.255.150.25 MONITOR & HUNT
13 149.102.232.44 MONITOR & HUNT
14 149.102.232.93 MONITOR & HUNT
15 158.173.242.133 MONITOR & HUNT
16 147.78.168.67 MONITOR & HUNT

B. Suspected C2, payload and scanner infrastructure (open-source)

INDICATOR TYPE CONTEXT PRIORITY
92.118.112.100 IPv4 Dropper staging host BLOCK FIRST (egress)
http://92.118.112.100/nfs URL / staging Mirai-style loader fetched to /tmp, run with arg ‘php’ BLOCK FIRST (egress)
103.216.220.92 IPv4 Pre-disclosure exploit attempt, 17 Oct (Amazon MadPot) MONITOR & HUNT
31.223.184.166 IPv4 Shared anonymisation infrastructure MONITOR & HUNT
37.19.200.5 IPv4 Shared anonymisation infrastructure MONITOR & HUNT
134.209.159.64 IPv4 Shared anonymisation infrastructure MONITOR & HUNT
103.114.163.188 IPv4 Shared anonymisation infrastructure MONITOR & HUNT
95.217.98.37 IPv4 Shared anonymisation infrastructure MONITOR & HUNT
85.11.167.243 IPv4 Scanning with php2shell-scan user-agent (second sensor network) MONITOR & HUNT
45.198.224.169 IPv4 Scanning with php2shell-scan user-agent (second sensor network) MONITOR & HUNT
109.71.252.97 IPv4 Exploitation attempts against both CVEs (second sensor network) MONITOR & HUNT
php2shell-scan/109618 User-Agent Leak-derived scanner (Amazon, VulnCheck, ELLIO) DETECT
Mozilla/5.0 (php2shell-poc) User-Agent Public-PoC exploitation (VulnCheck, Vega) DETECT
uname -a; id; echo JACKALPOC Command / canary Blind-RCE validation; JACKALPOC in a response = execution DETECT

C. Malware hashes

HASH TYPE FAMILY / NOTE
0c5486f0…360d1486 SHA-256 ‘nfs’ second stage (ELF x86-64, stripped, 179,632 bytes)
b61a098fc62a2c2696e196dca78da71a MD5 ‘nfs’ second stage

D. Behavioural and host indicators (highest value)

  • Unusual multipart/form-data POSTs to non-upload endpoints; PHP_SESSION_UPLOAD_PROGRESS fields on endpoints that never take uploads; very high multipart part/field counts or deeply nested field names; bodies of a few hundred KB.
  • PHP worker crashes / OOM fatals in bursts (‘Allowed memory size exhausted’, ‘zend_mm_heap corrupted’, SIGSEGV) correlated with preceding multipart POSTs; HTTP 500 on PHP endpoints.
  • Web-server/PHP processes (php-fpm, php-cgi, httpd, apache2, lsphp) spawning shells, interpreters or download tools (sh, bash, curl, wget, nc, busybox), or executing from /tmp, /var/tmp, /dev/shm.
  • New or modified .php / .phtml / .phar files in web roots; .user.ini or .htaccess changes adding auto_prepend_file; new cron jobs, local users or SSH authorized_keys.
  • Abnormally large PHPSESSID values in Set-Cookie (memory disclosure); outbound connections from web workers to uncommon destinations or I2P egress.

07. IMPACT ASSESSMENT

V1 · 22 OCT 2026 · LIKELIHOOD · IMPACT · SEVERITY

DIMENSION ASSESSMENT
Likelihood HIGH. Public exploit tooling is circulating; scanning and early exploitation confirmed by multiple vendors before and immediately after patch release on 21 October 2026. A disciplined DPRK-nexus actor is actively planning sector- and geography-specific targeting.
Potential impact CRITICAL. Unauthenticated RCE on internet-facing PHP enables web-shell deployment, credential and configuration theft, data exfiltration, ransomware and lateral movement, independent of the CMS or framework. Lazarus-ecosystem targeting extends the worst case to financial theft, destruction and long-term espionage.
Overall severity CRITICAL. Confidence HIGH in the vulnerability and general threat; attribution to the Lazarus ecosystem MODERATE.
Time sensitivity IMMEDIATE. The remediation window is open but closing rapidly. End-of-life PHP (8.1 and earlier) has no upstream fix and requires migration or verified backports. Forensic visibility is poor, so detection must lean on process and network telemetry, and investigations should start from 17 October 2026.

08. IMMEDIATE RECOMMENDED ACTIONS

V1 · 22 OCT 2026 · PATCH · ISOLATE · HUNT

PRIORITY ACTION
P1 · NOW Inventory every PHP runtime (VMs, containers, Kubernetes, appliances, CI/CD, shared hosting, bundled PHP). Prioritise internet-facing systems; confirm the live web-serving process version (Apache/FPM), not only the CLI binary.
P1 · NOW Patch to PHP 8.5.12+, 8.4.27+, 8.3.36+ or 8.2.35+ (or a verified distribution backport). Restart ALL PHP workers; a reload that keeps old workers alive leaves the stale state in place.
P1 · NOW Isolate or take offline any internet-facing PHP that cannot be patched within hours. Highest priority: Apache mod_php. Apply per-CVE temporary controls (memory_limit, max_input_nesting_level, upload-progress disabled, WAF) until patched.
P2 · 72H Hunt for reconnaissance or exploitation since 17 October 2026: malformed multipart POSTs, session upload-progress anomalies, OOM/worker crashes, new PHP files, and any contact with the Section 06 indicators.
P2 · 72H If compromise is suspected, preserve volatile evidence BEFORE patching (a restart destroys the -109619 state), capture memory and logs, isolate the host, rebuild from a trusted image, and rotate all secrets reachable from the PHP worker.
P3 · 7 DAYS Notify relevant national CERTs and sector coordination channels; brief leadership; watch for I2P egress and Lazarus-linked exploitation; track updates on DeCYFIR through the launch window.
DETECTION
The strongest single signal is a PHP or web-server process spawning something it never normally spawns. Request-side signals (malformed multipart, upload-progress fields, JACKALPOC canary, php2shell-* User-Agents) are useful but noisy. Deploy the Sigma and Splunk content from the source advisory and hunt from 17 October 2026 onward.

B. SOURCING AND HANDLING

V1 · 22 OCT 2026 · CONFIDENCE · CONTACT
This advisory consolidates CYFIRMA closed-source channel collection (I2P human-intelligence monitoring), verified vulnerability intelligence (PHP Security Team advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp), open-source in-the-wild exploitation telemetry (Amazon MadPot, Cloudflare, Hadrian, Patchstack, VulnCheck, ELLIO, Vega), public exploit/PoC evidence (Wiz / Calif / OpenAI, Datadog Security Labs, VulnCheck, GitHub, JFrog, AhnLab ASEC), and historical Lazarus tradecraft analysis. No exploit code was executed or independently tested.

Confidence justification. HIGH confidence in the vulnerability and the general threat (technical details, targeting intent and channel activity are directly observed or independently verified). MODERATE confidence in specific attribution to the Lazarus ecosystem, which rests on language, operational pattern and historical tradecraft rather than definitive infrastructure or tooling overlap.

HANDLING AND CONTACT

THREAT ADVISORY · ALL VERSIONS
HANDLING
TLP:CLEAR. Public release; may be shared without restriction. All channel conversations in this consolidation are masked; operator handles are anonymised and exchanged host/IP lists are withheld.

CYFIRMA THREAT INTELLIGENCE
[email protected]
Consolidation of CYF-EWR-2026-1022 (v1–v3) and CYF-FS-2026-1029 (v4) · Reference CYF-FS-2026-1029-PHP2SHELL-DPRK