Early Warning – PHP2Shell (v3): Suspected DPRK Campaign Staging PHP2Shell Exploitation Against Global PHP Infrastructure
Korean-speaking operators have filtered a 216-host target set and are running low-and-slow PHP weakness checks from 21 compromised nodes against CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2, unauthenticated RCE in PHP core). This update carries the full Version 1–2 assessment forward.
HOW TO READ THIS ADVISORY
Every threat in a CYFIRMA early warning carries the same relevance strip. A filled marker means the threat meets that check; the closing cell gives severity under the fixed model in Appendix B, so the same threat always scores the same way.
This is Version 3 of a living advisory. Part 1 contains only what is new since Version 2 (23 October 2026). Part 2 reproduces the Version 1–2 assessment unchanged so the full picture sits in one document. Where Part 1 supersedes a statement in Part 2, Part 1 governs.
| INDUSTRY ● |
TECHNOLOGY ● |
GEOGRAPHY ● |
THREAT ACTOR ● |
ACTIVE IN PAST ● |
SEVERITY CRITICAL |
Industry
The threat targets or affects organisations in the sectors named in the tasking
Technology
It exploits a product or platform in common use across the targeted estate
Geography
It is active in, or prioritises, the countries and regions in scope
Threat Actor
A named, tracked adversary is attributed to the activity
Active in Past
The actor, or exploitation of the vulnerability, was observed in the last 90 days
Judgments use the estimative language and confidence levels in Appendix B. Likelihood describes the event; confidence describes the strength of the evidence behind it.
24 OCTOBER 2026 · GLOBAL · PRE-ATTACK NOTIFICATION · VERSION 3
Treat every internet-facing PHP host below 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as exposed, and any host still advertising an older PHP version as a likely member of the operators’ 216-host target set. Patch immediately, restart all workers, and hunt back to 17 October 2026, the earliest known exploitation. Block or closely monitor the 21 scan-node addresses added in this update together with the 17 Version 2 source addresses and the 15 staging addresses (Section 09).
The campaign has moved from reconnaissance into active, low-and-slow scanning of a filtered target set. Organisations in the prioritised sectors and geographies should assume they are in scope for deliberate targeting.
IMMINENCE INDEX
78 /100
90 = confirmed mass compromise · not re-scored in v3
CVSS V4.0
9.2 CRITICAL
both CVEs, unauthenticated RCE
CAMPAIGN INFRASTRUCTURE
15 IPv4
shared in-channel for staging · plus 17 (v2) and 21 (v3) source IPs
PRIORITY GEOGRAPHIES
12 incl. UAE, KSA
restated by the operators on 24 Oct
TARGETED SECTORS
8 3 tiers
government and BFSI first
EXPOSURE WINDOW
7 days
since earliest exploitation · ~1/3 of 216 hosts scanned
Key dates from CYFIRMA closed-source collection (22 and 24 October 2026) and open-source exploitation telemetry. The hunt window opens at the earliest known exploitation on 17 October 2026.
Tasking intercepted. Two handles active since March 2026, coordinating in a closed I2P channel; staging infrastructure shared in-channel.
Target set and scan nodes. On 24 October the operators reported 216 unpatched or partially mitigated hosts and named 21 scan nodes; the same addresses were seen performing web-shell tooling and upload-progress session-poisoning attempts.
Fixes available. Released 21 October for supported branches. PHP 8.1 and earlier has no official upstream fix.
Lazarus affiliation. Moderate confidence, resting on language, operational pattern and historical tradecraft.
Entry route. Crafted multipart/form-data requests, highest success against Apache mod_php in default prefork.
Faster weaponisation. AI-assisted triage of public PoCs compresses the gap from disclosure to reliable exploit.
Launch date. No window stated by the handlers as of 24 October; the next milestone is their refined shortlist of highest-confidence hosts.
Mass compromise. None confirmed for this actor, which holds the imminence index below 90.
Named victims. The 216-host spreadsheet sits at the operators’ collection point and has not been seen; no organisation is identified in this advisory.
| # | PRIORITY | ACTION | OWNER | DUE |
| 1 | P1 · NOW | Block or monitor the 38 source addresses. 21 scan nodes (U3) and 17 Version 2 IPs (09 B) at perimeter and host; monitor and hunt the 15 staging IPs (09 A). | Network / SOC | 24 Oct |
| 2 | P1 · NOW | Patch and restart every worker. A reload that keeps old workers alive leaves stale state in place. Hosts still bannering older PHP are the ones the operators kept. | Infrastructure | 24 Oct |
| 3 | P1 · NOW | Isolate what cannot be patched within hours. Apache mod_php first; apply the per-CVE temporary controls in Section 08. | Infra & Risk | 24 Oct |
| 4 | P2 · 72H | Hunt back to 17 October across extended windows. The scanning is deliberately low-volume; rate-based alerts will miss it. Prior contact with listed addresses, multipart anomalies, worker crashes, shells spawned by PHP. | SOC | 27 Oct |
| 5 | P2 · 72H | Preserve evidence before patching suspect hosts. A restart destroys CVE-2026-109619 state. | Incident Response | 27 Oct |
| 6 | P3 · 7D | Notify CERTs and brief leadership. Watch for the Section 09 infrastructure, I2P egress, a launch statement or the operators’ refined shortlist. | CISO Office | 31 Oct |
PART 1 · VERSION 3 UPDATE · 24 OCTOBER 2026
This part contains only what is new since Version 2 (23 October 2026). It supersedes Part 2 wherever the two differ.
WHAT CHANGED · RECONNAISSANCE TO ACTIVE SCANNING
On 24 October 2026 (~01:47–02:22, as displayed in the channel), the operators of the closed I2P channel monitored since 22 October reported completion of an initial target set: 216 hosts that still appear unpatched or only partially mitigated for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). The first filtered target list, expected by 25 October in Versions 1 and 2, was therefore reported ready a day early. The operators stated that active PHP weakness checks are being run from a separate set of 21 compromised nodes, distinct from the earlier staging and collection IPs, and that scanning is low-volume and paced with deliberate avoidance of broad, noisy sweeps. At the time of the exchange roughly one third of the target set had already been touched.
The exchange indicates that the campaign has progressed from reconnaissance and infrastructure staging into active, low-and-slow scanning of a filtered target set. Unlike Version 2, which could not tie the 17 newly observed source IPs to the channel, the 21 addresses in U3 are the same addresses the operators named as the nodes running their PHP weakness checks, and they were observed in the 8 hours preceding this issue performing PHP web shell tooling and upload progress session poisoning attempts. They should be treated as DPRK-nexus scanning infrastructure and blocked or closely monitored alongside the 17 addresses published in Version 2.
CYFIRMA continues to assess with HIGH confidence that a North Korean state-nexus threat actor, a Korean-speaking operator assessed to be affiliated with the Lazarus Group ecosystem (Lazarus, APT38, Hidden Cobra, ZINC / Diamond Sleet), is actively staging a global offensive campaign against internet-facing PHP runtimes vulnerable to PHP2Shell. No launch date has been stated.
Target list status: from “expected by 25 October” to “reported ready, 216 hosts, first pass under way”.
Indicators: 21 scan-node addresses added, now tied to the channel; the 17 Version 2 addresses and the 15 staging addresses remain valid.
Tradecraft: infrastructure separation, low-and-slow pacing, node rotation and burn discipline confirmed by the operators.
Unchanged: actor assessment, vulnerability analysis, fixed versions, hunt-from date (17 October 2026), temporary controls.
NEW INTELLIGENCE SUMMARY · CHANNEL ACTIVITIES · 24 OCTOBER 2026
Updated on 24 October 2026 (~01:47–02:22). The operators of the closed I2P channel ████ █ █ ██ (████ ████ ██████) (handles 전███ 2 (Je████████ 2) and 최██ (C██████)) reported completion of an initial target set. They claimed to have identified 216 hosts that still appear unpatched or only partially mitigated for the PHP2Shell vulnerabilities.
Target set characteristics
| ATTRIBUTE | DETAIL |
| Hosts identified | 216 hosts that still look unpatched or partially exposed to PHP2Shell. First batch reported ready at ~01:47 on 24 October 2026. |
| Geographic coverage | Matches previously stated priorities: USA, Japan, Thailand, Indonesia, South Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia and the EU. |
| Sector mix | Government, financial institutions, logistics, airports / aviation, manufacturing and online transaction platforms. |
| Selection criteria | Hosts bannering the fixed versions, or sitting behind heavy filtering, were dropped. The remaining 216 still advertise older PHP. |
| Collection point | Target spreadsheet is staged at the collection point with sector and country tags already recorded. Scan results are written back to the same sheet under a separate column to show which hosts look more promising. |
| Scan progress | Roughly one third of the 216 hosts (estimate) had been touched by the scan nodes at ~02:10. The first pass across all hosts and a refined shortlist were due later on 24 October 2026. |
| Next step | From the shortlist of highest-confidence hosts, the operators will decide which public approaches are worth adapting. |
Scanning infrastructure and tradecraft
The operators stated that they are conducting active PHP weakness checks using a separate set of compromised nodes, distinct from the earlier staging and collection IPs. Scanning is described as low-volume and paced, with deliberate avoidance of broad, noisy sweeps.
| TRADECRAFT | OBSERVATION |
| Infrastructure separation | The new scan nodes are separate from the earlier preparation addresses; confirmed by the operator at ~02:04. |
| Low-and-slow pacing | Volume is kept low and paced so that not every target is lit up at once; no broad noisy sweeps. |
| Node rotation | Operators rotate through the node list, logging which addresses respond with the expected indicators. |
| Burn discipline | Nodes showing filtering or rate-limiting are marked, pulled from the active set and not reused (“do not reuse burned addresses”). |
ASSESSMENT
The exchange indicates the campaign has progressed from reconnaissance and infrastructure staging into active, low-and-slow scanning of a filtered target set. The 21 scan-node addresses named by the operators are the same addresses CYFIRMA observed in the 8 hours before this issue performing PHP web shell tooling and upload progress session poisoning attempts (U3). Because the operators describe these nodes as compromised, some may belong to victim organisations; block at the perimeter and hunt in logs for prior contact rather than assume ownership.
OBSERVED 24 OCTOBER 2026 · SCAN-NODE INFRASTRUCTURE · BLOCK / MONITOR
Observed techniques
| TECHNIQUE | DESCRIPTION |
| PHP web shell tooling | Deployment or use of PHP-based web shells commonly leveraged for remote code execution, persistence and post-exploitation on compromised web servers. |
| Upload progress session poisoning | Exploitation of PHP’s session upload progress feature (via specially crafted multipart/form-data requests) to poison session data. This technique can be used to achieve remote code execution or session hijacking under certain configurations when session data is improperly handled or when combined with local file inclusion or related weaknesses. |
New suspected source IP addresses associated with adversarial activity on 24 October 2026
Suspected source IP addresses identified in the 8 hours before this issue performing PHP web shell tooling and upload progress session poisoning attempts (21 addresses). The channel operators named the same addresses as the nodes currently running their PHP weakness checks. These supplement the 17 addresses published in Version 2 (Section 09 B), which remain valid. Indicators are defanged.
| # | IPV4 | ACTIVITY | PRIORITY |
| 1 | 142.93.155[.]162 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 2 | 134.122.38[.]73 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 3 | 5.255.114[.]109 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 4 | 165.22.232[.]198 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 5 | 159.223.59[.]200 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 6 | 192.177.131[.]13 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 7 | 94.154.42[.]149 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 8 | 173.249.16[.]178 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 9 | 170.64.224[.]137 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 10 | 170.64.226[.]40 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 11 | 45.148.10[.]80 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 12 | 152.237.230[.]29 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 13 | 146.70.194[.]93 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 14 | 185.157.109[.]60 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 15 | 143.246.213[.]138 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 16 | 144.91.70[.]51 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 17 | 217.60.196[.]124 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 18 | 151.253.243[.]219 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 19 | 23.106.131[.]214 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 20 | 173.249.16[.]192 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
| 21 | 45.148.10[.]201 | PHP web shell tooling / upload progress session poisoning | BLOCK / MONITOR |
CONVERSATION INTELLIGENCE AND CONTEXT · TRANSLATED TRANSCRIPT · SOURCE EVIDENCE
Source: excerpts from the closed I2P channel ████ █ █ ██ (████ ████ ██████) on 24 October 2026, shown in loose English translation with operational detail withheld. Times are approximate and as displayed in the channel. Speakers: 전███ 2 (Je████████ 2) (tasking / lead) and 최██ (C██████) (collection / scanning). The list of 21 scan-node addresses posted at ~01:57 is abbreviated here and is given in full in U3.
전███ 2 (Je████████ 2) 24 Oct 2026 · ~01:47 █████ 216 hosts █████ unpatched or partially exposed █████ priority regions: USA, Japan, Thailand, Indonesia, South Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia, and the EU. █████ government, financial, logistics, airports, manufacturing, and online transaction platforms. █████ collection point.
최██ (C██████) 24 Oct 2026 · ~01:50 Good.
전███ 2 (Je████████ 2) 24 Oct 2026 · ~01:53 █████ bannered the fixed versions █████ heavy filtering █████ dropped. Remaining 216 █████ older PHP. █████ sector and country tags █████
최██ (C██████) 24 Oct 2026 · ~01:57 █████ additional compromised infrastructure █████ nodes currently running the PHP weakness checks: [21 addresses; see U3].
전███ 2 (Je████████ 2) 24 Oct 2026 · ~02:01 █████ separate from the earlier staging addresses █████
최██ (C██████) 24 Oct 2026 · ~02:04 Correct. █████ actually running the checks. █████ low and paced █████ No broad noisy sweeps.
전███ 2 (Je████████ 2) 24 Oct 2026 · ~02:07 █████ how many of the 216 █████ already been touched █████
최██ (C██████) 24 Oct 2026 · ~02:10 Roughly a third so far. █████ rotating through the node list █████ expected indicators. █████ same spreadsheet under a separate column █████
전███ 2 (Je████████ 2) 24 Oct 2026 · ~02:13 Keep the rotation slow. █████ blocked or attract attention, drop them immediately █████ Do not reuse burned addresses.
최██ (C██████) 24 Oct 2026 · ~02:16 █████ signs of filtering or rate-limiting █████ pull it from the active set. █████ holding.
전███ 2 (Je████████ 2) 24 Oct 2026 · ~02:19 █████ first pass across all 216 █████ shortlist of the highest-confidence ones. █████ which public approaches are worth adapting.
최██ (C██████) 24 Oct 2026 · ~02:22 Agreed. █████ full first-pass results and the refined shortlist █████ later today.
전███ 2 (Je████████ 2) 24 Oct 2026 · ~02:12 Perfect. (Timestamp as displayed in the source, which shows this message after the ~02:22 entry.)
Source evidence: channel screenshots
Screenshots of the closed I2P forum thread and the associated chat exchange, 24 October 2026. Original Korean text retained. Operator handles, the channel name, the I2P destination, the scan-node address lists and the body of most posts are masked; enough remains visible to evidence the structure, timing and sequence of the exchange.
Figure 1. Closed I2P forum thread, 24 October 2026 (redacted).
Figure 2. Chat exchange between the two channel operators, 24 October 2026 (redacted).
PLANNED LAUNCH
No launch date or window has been stated as of 24 October 2026. The next adversary milestone is the first-pass result across all 216 hosts and the refined shortlist of highest-confidence hosts, from which the operators will choose which public exploit approaches to adapt. The channel remains under continuous monitoring.
WHAT THIS UPDATE ADDS · STANDING ACTIONS REMAIN IN FORCE
| PRIORITY | ACTION |
| P1 · NOW | Block or closely monitor traffic from the 21 addresses in U3 at the perimeter and host level, in addition to the 17 addresses published in Version 2 (Section 09 B) and the 15 staging addresses captured on 22 October (Section 09 A). |
| P1 · NOW | Hunt in web server, WAF and proxy logs for prior contact with the listed addresses, and review web roots for unexpected PHP files. The operators describe their scanning as low-volume and paced, so review extended time windows rather than relying on rate-based alerts. |
| P2 · TODAY | Prioritise patching of internet-facing hosts that still advertise older PHP versions; the operators removed hosts bannering the fixed versions from their target set, so a current banner is itself a de-selection criterion. |
CONTINUING ACTIONS FROM VERSIONS 1 AND 2
The recommendations in Section 08 remain in force, in particular: patching to PHP 8.5.12+, 8.4.27+, 8.3.36+ or 8.2.35+; restarting all PHP workers; isolating unpatchable internet-facing PHP; the per-CVE temporary controls; hunting from 17 October 2026; and blocking the 17 addresses published in Version 2. This update adds the 21 addresses above.
PART 2 · BASELINE ASSESSMENT · VERSIONS 1–2 · 22–23 OCTOBER 2026
The original pre-attack assessment (as published in the 23 October First Sight edition) is reproduced here in full so that this document is self-contained. Statements of expectation (for example “first filtered target list due by 25 October 2026”) reflect the position on 23 October 2026 and are superseded by Part 1 where they differ.
STATE-NEXUS · RECONNAISSANCE TO WEAPONISATION
Suspected DPRK state-nexus actor staging global exploitation of PHP2Shell
| INDUSTRY ● |
TECHNOLOGY ● |
GEOGRAPHY ● |
THREAT ACTOR ● |
ACTIVE IN PAST ● |
SEVERITY CRITICAL |
On 22 October 2026 (≈11:00 JST / 10:00 SGT), CYFIRMA closed-source collection surfaced a Korean-speaking threat actor coordinating, through a closed I2P channel, global reconnaissance and attack planning against all web-accessible assets carrying the two critical PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The tasking explicitly prioritises national government agencies, banks and financial institutions, manufacturing, logistics, shipping, airports and aviation, online transaction platforms, trading companies and construction firms across the United States, Japan, Thailand, Indonesia, South Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia and the European Union. Fifteen pieces of campaign infrastructure were shared in-channel for staging and launch. On 23 October 2026, CYFIRMA identified 17 suspected source IP addresses that, within an 8-hour window, were performing PHP web shell tooling and upload-progress session poisoning attempts; on their own these did not link to the channel and were published as additional hunting and blocking indicators.
Threat snapshot
| ATTRIBUTE | DETAIL | READING |
| Threat actor | DPRK state-nexus operator / small team. Suspected link to Lazarus Group (APT38 / Hidden Cobra / ZINC). | STATE-NEXUS |
| Motivation | Financial gain · Espionage · Disruption. Initial-access brokerage, crypto theft, ransomware; state-nexus espionage; operational disruption. | DUAL MANDATE |
| Assessed launch window | Not yet stated. Reconnaissance ongoing since 22 Oct 2026. First filtered target list expected by 25 Oct 2026. Rapid weaponisation anticipated. | HOURS TO DAYS |
| Attack surface | Global internet-facing PHP estate: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed LSAPI, embedded PHP in appliances and hosting control panels. Highest risk: unpatched Apache mod_php. | CRITICAL |
| Attribution confidence | HIGH (campaign activity): language, channel activity, targeting pattern. MODERATE (Lazarus link): historical Lazarus web-shell tradecraft. | HIGH / MODERATE |
IMMINENCE INDEX · 78 / 100
Targets identified (all internet-facing PHP); public exploit tooling circulating; active scanning and early in-the-wild exploitation observed globally; the channel is discussing launch readiness and sector prioritisation. The absence of confirmed mass successful compromise attributable to this specific actor keeps the index below 90.
Key judgments
| # | JUDGMENT | CONF. |
| 01 | A Korean-speaking, suspected DPRK state-nexus actor behind the campaign is in the reconnaissance-to-weaponisation phase against the global PHP estate. CYFIRMA adversary monitoring confirms explicit intent to mass-identify web-accessible assets carrying CVE-2026-109618 and CVE-2026-109619, de-conflict them by country and sector, and adapt public exploit code rather than develop novel primitives. | HIGH (intent, activity) · MODERATE (Lazarus link) |
| 02 | The most likely initial access vector is exploitation of public-facing PHP services via crafted multipart/form-data requests abusing the session upload-progress path (CVE-2026-109619) or out-of-memory corruption (CVE-2026-109618), with the highest success probability against Apache mod_php in its default prefork configuration. Expected tradecraft aligns with historical Lazarus use of PHP/ASP web shells and compromised web infrastructure for first-stage command-and-control. | MODERATE |
| 03 | Timing is opportunistic and tied to exploit readiness rather than an external trigger. The operation fuses financial motivation (initial-access resale, cryptocurrency theft, ransomware precursors, credential theft) with state-nexus espionage objectives. Deliberate sector and geographic prioritisation, with government and financial institutions first, distinguishes this activity from commodity opportunistic scanning and raises the consequence ceiling for targeted organisations. | MODERATE |
| 04 | AI-assisted triage is being used by the actor to rank public proof-of-concept repositories and accelerate reconnaissance, compressing the historical gap between disclosure and reliable weaponisation. Patch and mitigation timelines should be measured in hours, not days. | MODERATE |
LAZARUS GROUP ECOSYSTEM · DPRK RECONNAISSANCE GENERAL BUREAU
DESIGNATION
Lazarus Group ecosystem. Korean-speaking operator / small team; handles 전███ (Je████████) and 최██ (C██████).
ATTRIBUTION
State-nexus · North Korea (DPRK). Reconnaissance General Bureau (RGB) / Bureau 121 and subordinate offensive cyber units.
KNOWN ALIASES
APT38, Hidden Cobra, ZINC, Diamond Sleet. Related clusters: BlueNoroff, Andariel, Kimsuky.
ACTIVE SINCE
Handles active since March 2026. Campaign discussion first observed 22 Oct 2026 (≈11:00 JST).
ATTRIBUTION CONFIDENCE
MODERATE. Behavioural and linguistic indicators rather than infrastructure or malware-family overlap.
OPERATIONAL STYLE
Disciplined, access-focused. Harvests public PoCs, ranks them with AI, lab-validates before use, avoids noisy scanning.
CYFIRMA assesses with moderate confidence that the operator is linked to the North Korean state-sponsored threat ecosystem directed by the Reconnaissance General Bureau (RGB), the DPRK military intelligence organisation widely assessed to oversee Bureau 121 and its subordinate offensive cyber units. The Lazarus Group is the umbrella designation most consistent with the observed language, operational style and historical targeting of web infrastructure.
Assessed objectives. Monetise broad, opportunistic PHP2Shell access through deliberate, high-value targeting: initial-access resale, cryptocurrency theft, ransomware precursors and credential theft, fused with state-nexus espionage against government and financial institutions first, then logistics, ports, airports and manufacturing.
The Lazarus ecosystem at a glance
“Lazarus” is best understood as a family of related RGB-directed clusters that share tooling, infrastructure and tasking. Any of the clusters below, or a shared access team feeding them, could operationalise PHP2Shell access.
| CLUSTER (COMMON ALIASES) | PRIMARY MANDATE | RELEVANCE TO PHP2SHELL |
| Lazarus Group (APT38, Hidden Cobra, ZINC, Diamond Sleet) | Financial theft at scale; destructive operations; espionage | Documented use of compromised web servers and web shells for C2 and staging; opportunistic mass-RCE weaponisation |
| APT38 / BlueNoroff (Sapphire Sleet, Stardust Chollima) | Financial institutions, SWIFT networks, cryptocurrency and DeFi theft | BFSI and crypto/trading platforms are top-tier targets in the intercepted tasking |
| Andariel (Silent Chollima, Onyx Sleet, DarkSeoul) | Espionage against defence, aerospace, healthcare; opportunistic ransomware | Watering-hole and web-server compromise tradecraft (e.g. SyncHole); ransomware precursor risk |
| Kimsuky (Velvet Chollima, Emerald Sleet, APT43) | Strategic intelligence collection; spear-phishing; credential theft | May consume web-server footholds for collection and onward credential harvesting |
Historical targeting and PHP / web tradecraft
ANALYTIC NOTE
The Lazarus ecosystem’s dual financial-and-espionage mandate means access gained here could feed initial-access resale, cryptocurrency theft, ransomware precursors, credential theft and long-term espionage. The consequence ceiling for a targeted organisation is therefore higher than for commodity opportunistic exploitation of the same flaw.
STRUCTURED EVALUATION · SUPPORTS VS ALTERNATIVE EXPLANATIONS
Assessment: the campaign is linked to the Lazarus Group ecosystem (DPRK) with MODERATE confidence. The assessment rests on behavioural and linguistic indicators rather than definitive infrastructure or malware-family overlap. Public reporting as of 22 October 2026 had not attributed PHP2Shell exploitation to any named actor; this assessed link is based on CYFIRMA collection.
| SUPPORTS DPRK / LAZARUS ASSESSMENT | UNCERTAINTIES / ALTERNATIVE EXPLANATIONS |
| Korean-language operational tasking in a closed, OPSEC-conscious I2P channel | Language alone is not attribution; could reflect a Korean-speaking criminal crew without state direction |
| Sector prioritisation (government + BFSI first) mirrors the Lazarus dual mandate | Government and BFSI are high-value to many financially motivated actors |
| Geographic spread and interest in trading/crypto platforms align with APT38/BlueNoroff | Open-source PHP2Shell exploitation is broadly opportunistic and multi-actor |
| Historical Lazarus use of PHP/web-shell tradecraft and compromised web C2 | No confirmed malware-family or infrastructure overlap with a named Lazarus cluster yet |
| Disciplined, access-focused tradecraft (AI-assisted PoC triage, lab validation, scan avoidance) | Tradecraft discipline is increasingly common across capable criminal groups |
LOW
▼ revised down if collection indicates an unaffiliated Korean-speaking criminal group
◆ MODERATE · NET ASSESSMENT
HIGH
▲ revised up on infrastructure / tooling overlap, a launch statement or confirmed compromises
Net assessment: MODERATE confidence in a Lazarus-ecosystem link. Confidence will be revised upward on observation of infrastructure or tooling overlap with a named cluster, a launch statement, or confirmed compromises; and revised downward if collection indicates an unaffiliated Korean-speaking criminal group.
COLLECTION SOURCE · PRIORITISED SECTORS AND GEOGRAPHIES · ASSETS IN SCOPE
Collection source: closed I2P channel
| ATTRIBUTE | DETAIL |
| Platform | I2P (Invisible Internet Project), closed channel |
| Channel | ████ █ █ ██ (████ ████ ██████) |
| Address | ████████████████████████████████████████████████████.b32.i2p |
| Observed handles | 전███ (Je████████), active since March 2026, assessed role: tasking / lead. 최██ (C██████), active since March 2026, assessed role: collection / exploit triage |
| Activity | Closed sharing of target lists, exploit-hosting infrastructure, tasking and prioritisation; discussion of global reconnaissance against web-accessible PHP assets carrying CVE-2026-109618 and CVE-2026-109619 |
Handles are operator aliases, not confirmed identities.
Prioritised targeting (from the 22 October 2026 tasking)
| TIER | SECTORS | US | JP | KR | TH | ID | TW | AU | IN | SG | UAE | KSA | EU |
|
T1 |
National government agencies; banks and financial institutions |
● | ● | ● | ● | ● | ○ | ○ | ○ | ○ | ● | ● | ● |
|
T2 |
Manufacturing; logistics, shipping and ports; airports and aviation | ○ | ● | ○ | ● | ● | ● | ● | ● | ○ | ● | ○ | ○ |
| T3 | Online transaction / trading platforms; trading companies; construction | ○ | ○ | ○ | ○ | ○ | ○ | ○ | ○ | ● | ● | ● | ● |
● = geography named for that tier in the intercepted tasking. Source: intercepted tasking, 22 October 2026. Reconstructed from the operators’ stated priorities; the operators did not publish a formal matrix.
Assets in scope
All internet-facing PHP runtimes: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed (LSAPI), and embedded PHP in appliances and hosting control panels (cPanel, Plesk). Highest risk: unpatched Apache mod_php. No specific customer hosts were named in-channel; the campaign is global and begins opportunistic before narrowing to a filtered, prioritised list.
Technical note: no host-level verification (ASN / provider, port, path, response, certificate CN/O, stack) was possible at the time of Versions 1–2 because the handlers had not yet produced a filtered host list. See Part 1 for the 24 October position.
PHP2SHELL · CVE-2026-109618 · CVE-2026-109619
PHP2Shell refers to two critical unauthenticated remote code execution vulnerabilities in the PHP runtime itself. Both carry a CVSS v4.0 score of 9.2 (PHP Security Team). Technical details leaked publicly on 20 October 2026, ahead of coordinated disclosure; the PHP project released fixes on 21 October 2026. Both share one root cause: PHP’s longjmp()-based “bailout” aborts a request mid-operation and leaves internal state half-built or pointing at freed memory. In worker-based deployments, a subsequent request handled by the same worker inherits that stale state.
CVE-2026-109618: RCE via out-of-memory corruption (GHSA-w8hw-w9fx-j79w)
CVE-2026-109619: RCE via stale global state (GHSA-6wmf-4rv5-p3rp)
INTERIM CONTROLS DIFFER BY CVE
Early coverage tied the session upload-progress field to CVE-2026-109618. Per PHP’s advisories it belongs to CVE-2026-109619 only; disabling upload progress does nothing for -109618. The two bugs require different interim controls (Section 08).
Exposure by deployment (SAPI)
| SAPI | CVE-2026-109618 (OOM) | CVE-2026-109619 (STALE STATE) |
| Apache mod_php | Confirmed, full unauthenticated RCE, default limits, prefork | Confirmed |
| PHP-FPM | Susceptible per source analysis; no full exploit shown | Upload-progress path validated |
| FrankenPHP | Likely (similar to mod_php) | Not immune; no default consumer found |
| LiteSpeed (LSAPI) | Likely, unvalidated | Conditional |
| php-cgi | At risk per PHP | At risk per PHP |
Affected and fixed versions
| BRANCH | STATUS | FIX |
| 8.5 | SUPPORTED | 8.5.12 |
| 8.4 | SUPPORTED | 8.4.27 |
| 8.3 | SECURITY-ONLY | 8.3.36 |
| 8.2 | SECURITY-ONLY | 8.2.35 |
| 8.1, 8.0, 7.4 | END OF LIFE | Minimal source backports only; distribution / LTS vendor builds (e.g. cPanel EasyApache 4, CloudLinux alt-php, TuxCare, Plesk; confirm branch coverage with the vendor) |
| 5.4 to 7.3 | END OF LIFE | No fix; migrate or isolate |
EXPLOITABILITY NOTE
Triggering the bug is easy; reliable code execution is not. The attacker must land a follow-up request on the same worker and shape heap data into the freed space, otherwise the worker crashes or responds normally. Non-RCE outcomes already demonstrated: worker crash (DoS), arbitrary file read via OPcache, and ~67 KB process-memory disclosure.
VulnCheck update (22 October 2026, 19:00 ET). VulnCheck now reports that its exploit achieves RCE on x86-64 with ASLR enabled against PHP 8.4.10 to 8.4.26, that its memory leak works on ARM64 but RCE is not yet functional there, and that at least one public PoC bypassed ASLR on x86-64 for a single version (8.4.26). This supersedes its earlier position that no public PoC bypassed ASLR on x86-64.
MITRE ATT&CK-MAPPED PROGRESSION
Mapped from intercepted tasking, open-source exploitation telemetry and historical Lazarus web tradecraft. One unauthenticated multipart POST can reach code execution before any application code runs; there is no vulnerable route to discover and little application-layer trace.
Pivot: one crafted multipart POST against an unpatched worker is the whole initial-access step.
| PHASE | ANTICIPATED ACTIVITY | ATT&CK |
| Reconnaissance | Passive banner / version fingerprinting of PHP; country- and sector-segmented target list building; probing multipart endpoints and session upload-progress; AI-assisted ranking of public PoCs | T1595.002 · T1590.005 |
| Resource development | Acquisition/adaptation of public PHP2Shell exploit code; staging on campaign infrastructure; lab validation before use | T1588.005 · T1608.001 · T1583.004 |
| Initial access | Exploitation of CVE-2026-109618 / -109619 via crafted multipart/form-data for unauthenticated RCE; highest success on Apache mod_php | T1190 |
| Execution & persistence | Command execution as web-worker user; PHP/ASP web-shell deployment in web roots; cron and SSH-key implants; abandoned-config persistence | T1059.004 · T1505.003 · T1053.003 · T1098.004 |
| Credential access & collection | Harvesting of wp-config.php, .env, database credentials and API keys; ~67 KB memory disclosure via PHPSESSID; config/file reads via OPcache primitive | T1552.001 · T1005 |
| C2 & impact | Loader fetch-and-run from staging host (Mirai convention); outbound C2 from web workers; cryptomining, ransomware, lateral movement; data exfiltration | T1105 · T1210 · T1041 · T1496 · T1486 |
LIKELIHOOD · IMPACT · SEVERITY · TIME SENSITIVITY
| DIMENSION | ASSESSMENT |
| Likelihood | HIGH. Public exploit tooling is circulating (varying reliability); scanning and early exploitation have been confirmed by multiple vendors (Amazon MadPot, Cloudflare, Hadrian, Patchstack) before and immediately after patch release on 21 October 2026. The operators, a disciplined, suspected DPRK-nexus actor, are actively planning sector- and geography-specific targeting. |
| Potential impact | CRITICAL. Unauthenticated RCE on internet-facing PHP enables web-shell deployment, credential and configuration theft, data exfiltration, cryptomining, ransomware and lateral movement, independent of the CMS, framework or plugins in use. For Lazarus-ecosystem targeting, the realistic worst case extends to financial theft, destructive operations and long-term espionage access. Regulatory (GDPR, sectoral), financial and reputational consequences are severe. |
| Overall severity | CRITICAL. Confidence HIGH in the threat; Lazarus-ecosystem link MODERATE. The absence of confirmed mass successful compromise attributable to this actor holds the imminence index at 78 / 100, below the 90 threshold. |
| Time sensitivity | IMMEDIATE. Patches have been available since 21 October 2026; the remediation window before mass weaponisation is closing. End-of-life PHP (8.1 and earlier) has no official upstream fix. Forensic visibility is poor (the bug fires before application code runs), so detection must lean on process and network telemetry, and investigations should start from 17 October 2026. |
PRIORITISED · PATCH, ISOLATE, HUNT
| PRIORITY | ACTION |
| P1 · NOW | Inventory every PHP runtime (VMs, containers, Kubernetes, appliances, CI/CD, shared hosting, bundled PHP in vendor software). Prioritise internet-facing systems; confirm the live web-serving process version (Apache/FPM), not only the CLI binary. |
| P1 · NOW | Patch to PHP 8.5.12+, 8.4.27+, 8.3.36+ or 8.2.35+ (or a verified vendor/distribution backport). Restart ALL PHP workers and validate the running binary; a reload that keeps old workers alive leaves the stale state in place. |
| P1 · NOW | Isolate or take offline any internet-facing PHP that cannot be patched within hours. Highest priority: Apache mod_php. Organisations in the prioritised sectors and geographies (Section 04) should treat this as urgent. |
| P1 · NOW | Block or closely monitor traffic from the 17 suspected source IPs (Section 09 B) at the perimeter and host level. |
| P2 · 72H | Hunt for reconnaissance or exploitation since 17 October 2026: malformed multipart POSTs, session upload-progress anomalies, PHP worker crashes/OOM, web-server processes spawning shells, new PHP files in web roots, and any contact with the Section 09 indicators. |
| P2 · 72H | If compromise is suspected: preserve volatile evidence BEFORE patching (restarting workers destroys CVE-2026-109619 state), capture memory and logs, isolate the host, rebuild from a trusted patched image, and rotate all secrets accessible to the PHP worker. |
| P3 · 7 DAYS | Notify relevant national CERTs and sector coordination channels; brief leadership. Watch for I2P egress and for the campaign infrastructure in Section 09 A. Continue monitoring for a launch statement or Lazarus-linked exploitation. |
TEMPORARY CONTROLS DO NOT REPLACE PATCHING
PHP states a fixed release is the only complete mitigation. The controls below reduce exposure while patching is scheduled.
CVE-2026-109618: memory_limit = -1 (admin-enforced via php_admin_value); set a low post_max_size (8M where uploads are not required, 32M where they are); constrain multipart body size, part and header counts at the reverse proxy; lower max_input_nesting_level to 32; use cgroup/container memory boundaries (not RLIMIT_AS/RLIMIT_DATA).
CVE-2026-109619: session.upload_progress.enabled = 0 (administrative config, not ini_set); fatal_error_backtraces = 0 (PHP 8.5); remove pre-init diagnostics and attacker-reachable fatal paths; pm.max_requests = 1 where performance allows.
Defence in depth: deploy/confirm WAF protections as a supplement; lock origins to CDN/WAF ranges so attackers cannot bypass to the origin IP; egress-filter web workers and block 92.118.112[.]100 / hxxp://92.118.112[.]100/nfs.
INFRASTRUCTURE · C2 & PAYLOAD · HASHES · HOST BEHAVIOUR
Deploy to perimeter, EDR and DNS controls. Indicators are defanged in tables. Several addresses are shared or anonymising infrastructure; investigate sightings before blocking. The 21 scan-node addresses added on 24 October 2026 are in Part 1, U3.
A. Campaign infrastructure (captured from adversary conversation, 22 October 2026)
Monitor and hunt rather than blind-block. Fifteen IPv4 addresses shared in-channel for staging, target-list hosting and launch, plus one possible variant (entry 16). Infrastructure roles are not fully differentiated. Entry 16 appears once, only in the direct-message exchange, and may be an actor typo of entry 4; it is included as a precaution. Priority: MONITOR & HUNT.
| # | IPV4 | ROLE | PRIORITY |
| 1 | 146.70.114[.]180 | Staging / target-list hosting / launch | MONITOR & HUNT |
| 2 | 146.70.114[.]182 | Staging / target-list hosting / launch | MONITOR & HUNT |
| 3 | 147.175.149[.]67 | Staging / target-list hosting / launch | MONITOR & HUNT |
| 4 | 147.78.168[.]57 | Staging / target-list hosting / launch | MONITOR & HUNT |
| 5 | 109.56.219[.]150 | Staging / target-list hosting / launch | MONITOR & HUNT |
| 6 | 158.173.75[.]178 | Staging / target-list hosting / launch | MONITOR & HUNT |
| 7 | 185.203.18[.]54 | Staging / target-list hosting / launch | MONITOR & HUNT |
| 8 | 185.235.212[.]105 | Staging / target-list hosting / launch | MONITOR & HUNT |
| 9 | 103.77.210[.]80 | Staging / target-list hosting / launch | MONITOR & HUNT |
| 10 | 128.90.176[.]13 | Staging / target-list hosting / launch | MONITOR & HUNT |
| 11 | 138.199.34[.]201 | Staging / target-list hosting / launch | MONITOR & HUNT |
| 12 | 145.255.150[.]25 | Staging / target-list hosting / launch | MONITOR & HUNT |
| 13 | 149.102.232[.]44 | Staging / target-list hosting / launch | MONITOR & HUNT |
| 14 | 149.102.232[.]93 | Staging / target-list hosting / launch | MONITOR & HUNT |
| 15 | 158.173.242[.]133 | Staging / target-list hosting / launch | MONITOR & HUNT |
| 16 | 147.78.168[.]67 | Staging / target-list hosting / launch (DM only; possible actor typo) | MONITOR & HUNT |
B. Suspected source IPs: web shell tooling and upload-progress session poisoning (identified 23 October 2026)
Identified within an 8-hour window on 23 October 2026. Not, on their own, linked to the DPRK-nexus channel. Priority: BLOCK / MONITOR; hunt in logs for prior contact.
| # | IPV4 | ACTIVITY | PRIORITY |
| 1 | 102.207.250[.]188 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 2 | 94.154.43[.]185 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 3 | 75.119.143[.]189 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 4 | 117.203.73[.]63 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 5 | 146.190.107[.]103 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 6 | 95.217.164[.]124 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 7 | 124.122.142[.]142 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 8 | 188.80.228[.]122 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 9 | 134.209.181[.]133 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 10 | 134.209.252[.]157 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 11 | 119.63.72[.]54 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 12 | 138.68.161[.]170 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 13 | 95.216.5[.]90 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 14 | 103.21.161[.]105 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 15 | 115.96.27[.]126 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 16 | 185.207.232[.]121 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
| 17 | 78.47.85[.]99 | PHP web shell tooling / upload-progress session poisoning | BLOCK / MONITOR |
C. Corroborating open-source exploitation infrastructure
Published by primary sources (Amazon, ELLIO, VulnCheck, Vega) as corroborating evidence of active PHP2Shell exploitation.
| INDICATOR | TYPE | CONTEXT | PRIORITY |
| 92.118.112[.]100 | IPv4 | Dropper staging host | BLOCK FIRST (egress) |
| hxxp://92.118.112[.]100/nfs | URL / staging | Mirai-style loader fetched to /tmp, run with arg ‘php’ | BLOCK FIRST (egress) |
| 103.216.220[.]92 | IPv4 | Pre-disclosure exploit attempt, 17 Oct (Amazon MadPot) | MONITOR & HUNT |
| php2shell-scan/109618 | User-Agent | Leak-derived scanner (Amazon, VulnCheck, ELLIO) | DETECT |
| php2shell-verify/1.0 · php2shell-109618 | User-Agent | Same scanner family, verification stage | DETECT |
| Mozilla/5.0 (php2shell-poc) | User-Agent | Public-PoC exploitation (VulnCheck, Vega) | DETECT |
| —-p2s… / —-p2shell | Multipart boundary | OOM exploit kit boundary prefix (ELLIO) | DETECT |
| uname -a; id; echo JACKALPOC | Command / canary | Blind-RCE validation; JACKALPOC in a response = execution | DETECT |
D. Malware hashes
| HASH | TYPE | FAMILY / NOTE |
| 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486 | SHA-256 | ‘nfs’ second stage (ELF x86-64, stripped, 179,632 bytes); single honeypot vendor report, not independently corroborated |
| b61a098fc62a2c2696e196dca78da71a | MD5 | ‘nfs’ second stage |
E. Behavioural and host indicators (highest value)
SIGMA · SPLUNK · HOST TRIAGE · YARA
The strongest single signal is a PHP or web-server process spawning something it never normally spawns. Request-side signals are useful but noisy; application logs will usually show nothing because no application code ran. Hunt from 17 October 2026 onward.
Sigma: PHP worker spawns shell or download tool
title: PHP2Shell – Shell/Download Tool Spawned by PHP Worker
status: experimental
logsource:
product: linux
category: process_creation
detection:
parent:
ParentImage|endswith: [‘/php-fpm’, ‘/php-cgi’, ‘/httpd’, ‘/apache2’, ‘/lsphp’, ‘/frankenphp’]
child:
Image|endswith: [‘/sh’, ‘/bash’, ‘/dash’, ‘/curl’, ‘/wget’, ‘/nc’, ‘/busybox’, ‘/python3’, ‘/perl’]
tmp:
Image|startswith: [‘/tmp/’, ‘/var/tmp/’, ‘/dev/shm/’]
condition: parent and (child or tmp)
level: high
tags:
– attack.t1190
– attack.t1059.004
Sigma: request-side tool indicators (web/WAF logs)
title: PHP2Shell – Known Tool User-Agents / Upload-Progress Field
status: experimental
logsource:
category: webserver
detection:
ua:
cs-user-agent|contains: [‘php2shell-scan’, ‘php2shell-109618’, ‘php2shell-verify’, ‘php2shell-poc’]
post:
cs-method: ‘POST’
body:
cs-body|contains: [‘PHP_SESSION_UPLOAD_PROGRESS’, ‘—-p2s’, ‘JACKALPOC’]
condition: ua or (post and body)
level: medium
Splunk: PHP worker child processes
index=edr parent_process_name IN (“php-fpm*”,”php-cgi*”,”httpd”,”apache2″,”lsphp”,”frankenphp”)
(process_name IN (“sh”,”bash”,”curl”,”wget”,”nc”,”busybox”,”python3″,”perl”)
OR process_path=”/tmp/*” OR process_path=”/dev/shm/*”)
earliest=”10/17/2026:00:00:00″
| stats count min(_time) as first values(process) as cmd by host user
| sort – count
Quick host triage (read-only)
php -v # confirm the SERVING binary, not only CLI
php -i | grep -E ‘session.upload_progress|memory_limit|post_max_size|max_input_nesting_level|fatal_error_backtraces|opcache.enable’
find /var/www -type f -name ‘*.php’ -newermt ‘2026-10-17’ -ls
find /tmp /var/tmp /dev/shm -type f -perm -u+x -newermt ‘2026-10-17’ -ls
grep -rIl -e ‘92.118.112.100’ -e ‘JACKALPOC’ /var/log 2>/dev/null
YARA
PHP2Shell exploitation happens in PHP worker memory before application code runs and writes no file by itself, so YARA cannot detect the exploit directly. It covers what the attack leaves behind: captured requests and logs, PHP session files, second-stage payloads and web shells dropped after successful RCE, and staged exploit tooling.
Validation status: the set compiles cleanly with yara-python 4.5.4 with warnings treated as errors, and passed a 72-case synthetic regression suite. It has not yet been tested against real application code; run it against clean WordPress, Drupal and Magento installations before deploying for alerting. Full rule text is in Appendix B.
YARA
PHP2Shell exploitation happens in PHP worker memory before application code runs and writes no file by itself, so YARA cannot detect the exploit directly. It covers what the attack leaves behind: captured requests and logs, PHP session files, second-stage payloads and web shells dropped after successful RCE, and staged exploit tooling.
Validation status: the set compiles cleanly with yara-python 4.5.4 with warnings treated as errors, and passed a 72-case synthetic regression suite. It has not yet been tested against real application code; run it against clean WordPress, Drupal and Magento installations before deploying for alerting. Full rule text is in Appendix B.
| RULE | WHAT IT DETECTS AND WHERE TO SCAN | SEV. |
| PHP2Shell_SecondStage_ELF_SHA256 | The second-stage ELF x86-64 binary (SHA-256 and exact size). Scan /tmp, /var/tmp, /dev/shm and web roots; the loader may delete the file after launch. | High |
| PHP2Shell_Captured_Request_Body_SHA256 | Saved scanner and OOM-tool request bodies by exact hash. Fragile: any change to boundary or field values defeats it. | Medium |
| PHP2Shell_Infrastructure_IPs_In_Content | Published anonymisation-network, scanner and staging IPs in logs and text content. A hit means investigate, not confirmed compromise. | Medium |
| PHP2Shell_Request_Shape_In_Capture | Scanner user-agents, boundaries, the JACKALPOC marker, or the exploit request shape. Run on per-request captures, not multi-request logs. | Medium |
| PHP2Shell_Log_Crash_Signatures | PHP and PHP-FPM log lines from trigger attempts. Side effects, not proof; correlate with multipart POSTs from the same source. | Low |
| PHP2Shell_Session_File_Anomaly | Session files (sess_*) containing PHP code, or a residual upload-progress entry with an empty-filename spray. | Medium |
| PHP_Webshell_Input_To_Exec_Heuristic | Generic web shells passing request input to execution or evaluation. Not PHP2Shell-specific; validate hits against application code. | Medium |
| PHP_Suspicious_Command_Execution_Hunting | Broad hunting for PHP files combining command execution with shell paths, request input or decoding. Hunting only, not alerting. | Low |
| PHP2Shell_Public_PoC_Script | Staged exploit scripts referencing PHP2Shell CVEs or tooling strings with the upload-progress field. Hits on analyst systems may also mean a trojanised PoC. | Low |
Deployment notes: seven of the nine rules match the rule file itself and other detection content; exclude rule repositories and threat-intelligence feeds from scans. User-agent, boundary and marker strings are trivially changed by attackers; weight the request-shape, session-file and payload rules over string matches.
PUBLIC POC EVIDENCE · 22 OCTOBER 2026 TRANSCRIPT · PLANNED LAUNCH
Public exploit and PoC evidence
Source-checked as of 22 October 2026. Public repositories should be treated as untrusted; validated research is not equivalent to a validated, production-ready exploit, and several circulating “PoCs” are fake and distribute malware (per JFrog, AhnLab ASEC). No exploit code was executed or independently tested in this assessment.
| SOURCE | EVIDENCE TYPE | STATUS / LIMITATION |
| PHP Security Team | Vendor advisory | VENDOR CONFIRMED: reliability varies by allocator, build, extensions, worker layout |
| Wiz / Calif / OpenAI | Original disclosure | RESEARCH REPRODUCED: frontier AI models used to chain the memory-safety flaws |
| Datadog Security Labs | Technical walkthrough | RESEARCH REPRODUCED: focuses on -109618; both reported reproduced |
| VulnCheck | Reproduction (qualified) | See Section 05 update; warns many public repos use the wrong mechanism |
| GitHub (9bie, dinosn, lzz0403, ikow, syrex1013) | Author-reported lab | UNVERIFIED / DISPUTED: CVE mapping and portability require scrutiny; some require GDB/local access |
| JFrog / AhnLab ASEC | Fake-PoC warning | Malicious and prank repositories circulating; do not run unaudited PoCs |
Channel evidence and artifacts
On 22 October 2026 the handlers shared campaign infrastructure and tasking related to exploit readiness in the closed I2P channel ████ █ █ ██ (████ ████ ██████). No specific customer hosts or victims were listed. Loosely translated from Korean; all times 22 October 2026, JST. THREAT ACTOR 1 = 전███ (Je████████) (tasking / lead). THREAT ACTOR 2 = 최██ (C██████) (collection / exploit triage).
전███ (Je████████) 22 Oct 2026 · ~11:00 JST █████ PHP runtime issues █████ internet-facing systems █████ national agencies, banks and financial institutions, manufacturing, logistics, shipping, airports and aviation, online transaction platforms, trading companies, and construction firms. Priority regions: USA, Japan, Thailand, Indonesia, Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia, and the EU.
최██ (C██████) 22 Oct 2026 · ~11:04 JST █████ passive collection of public banners and version strings for anything advertising PHP. █████ stay off anything that looks already heavily monitored.
전███ (Je████████) 22 Oct 2026 · ~11:07 JST █████ Separate the list by country and sector █████ government and financial sites first, then logistics, ports, airports, and manufacturing. █████ staging and collection points █████
최██ (C██████) 22 Oct 2026 · ~11:12 JST █████ intermediaries for hosting the target lists. █████ not perform active scans. █████ public GitHub notes and researcher write-ups █████
전███ (Je████████) 22 Oct 2026 · ~11:15 JST █████ public information only. Do not invent new primitives. █████ out-of-memory path █████ stale-state path. █████ common Apache and FPM setups without needing local access.
최██ (C██████) 22 Oct 2026 · ~11:19 JST █████ public technical descriptions █████ local AI for reconnaissance and to rank █████ public repositories █████ manually verify █████ controlled lab █████
전███ (Je████████) 22 Oct 2026 · ~11:23 JST AI is only for speed on sorting and validation of open material. █████ shortlist of likely-vulnerable hosts █████ No broad noisy scanning █████
최██ (C██████) 22 Oct 2026 · ~11:27 JST █████ country-and-sector target spreadsheet █████ Collection points stay on the infrastructure █████ flag any hosts that appear to have already applied the 21 October patches.
전███ (Je████████) 22 Oct 2026 · ~11:31 JST █████ first filtered list █████ public approaches █████ worth adapting.
Source: CYFIRMA closed-source collection, I2P channel ████ █ █ ██ (████ ████ ██████), 22 October 2026.
PLANNED LAUNCH (POSITION AS OF 23 OCTOBER 2026)
No specific launch date or window had been stated by the handlers as of 22 October 2026. The closest statement was C███████’s: “█████ country-and-sector target spreadsheet █████.” The first filtered target list was expected by 25 October 2026. Part 1 records that it was reported ready on 24 October 2026.
SEVERITY MODEL · ESTIMATIVE LANGUAGE · SOURCING AND CONFIDENCE · HANDLING · YARA RULES
Severity model
| LEVEL | MEANING |
| CRITICAL | Exploitation is imminent or under way against technology in scope, with a credible, capable actor and severe potential impact. Act within hours. |
| HIGH | A capable actor is targeting technology, sectors or geographies in scope; exploitation is likely within days. Act within 72 hours. |
| MODERATE | Relevant activity observed without evidence of imminent targeting. Act within the normal change cycle. |
Estimative language and confidence
| LIKELIHOOD (THE EVENT) | CONFIDENCE (THE EVIDENCE) |
| Very likely / likely / unlikely describe how probable CYFIRMA assesses an event to be. | High / moderate / low describe the quality, corroboration and independence of the underlying evidence. |
| In this advisory: exploitation of unpatched internet-facing PHP is very likely; deliberate targeting of the prioritised sectors and geographies is likely. | In this advisory: HIGH confidence in the vulnerability and the campaign activity (directly observed or independently verified); MODERATE confidence in the Lazarus-ecosystem link (language, operational pattern and historical tradecraft rather than infrastructure or tooling overlap). |
Sourcing and confidence justification
This advisory consolidates CYFIRMA closed-source channel collection (I2P human-intelligence monitoring, 22 and 24 October 2026), verified vulnerability intelligence (PHP Security Team advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp), open-source in-the-wild exploitation telemetry (Amazon MadPot, Cloudflare, Hadrian, Patchstack, VulnCheck, ELLIO, Vega), public exploit/PoC evidence (Wiz / Calif / OpenAI, Datadog Security Labs, VulnCheck, GitHub, JFrog, AhnLab ASEC), CYFIRMA detection of suspected source IPs on 23 and 24 October 2026, and historical Lazarus tradecraft analysis. No exploit code has been executed or independently tested in this assessment.
| SOURCE TYPE | CREDIBILITY AND BIAS |
| PHP Security Team advisories and GHSAs | Primary and authoritative. High credibility. |
| Discoverers (Calif, Wiz, OpenAI, Quarkslab) | High credibility on the vulnerability; security vendors and an AI research organisation with commercial interest in the disclosure; promotional in tone. |
| Exploitation telemetry vendors (Amazon, Cloudflare, Hadrian, Patchstack, VulnCheck, ELLIO, Vega) | Credible; commercial interest; each sees only its own sensors or customers. “Exploited in the wild” generally means attempts observed. |
| CYFIRMA closed-source collection | Proprietary human intelligence. Sourcing detail is withheld to protect collection. |
PHP2Shell technical details, the campaign’s targeting intent and channel activity are directly observed or independently verified, supporting HIGH confidence in the vulnerability and the general threat. Confidence in the link to the Lazarus ecosystem is MODERATE because it rests on language, operational pattern and historical tradecraft rather than definitive infrastructure or tooling overlap with a named Lazarus cluster. No confirmed mass successful exploitation by this actor has been observed. CYFIRMA will revise this assessment on further tasking, infrastructure differentiation or confirmed compromises.
Handling and contact
HANDLING
TLP:AMBER. Restricted to organisational security, risk and executive functions and directly affected constituents. Not for onward public sharing without authorisation.
VERIFICATION & CADENCE
Confirm with your CSM. Digital copies of this advisory and the IOC set are available on DeCYFIR. Next review: 25 October 2026.
CYFIRMA THREAT INTELLIGENCE
[email protected]
24/7 watch desk · Quote CYF-EWR-2026-1022-PHP2SHELL-DPRK
RE-ISSUE TRIGGERS
Channel under continuous monitoring. Re-issued on a launch statement, release of the operators’ first-pass shortlist, additional infrastructure, or confirmed exploitation.
Version history: v1 issued 22 October 2026 (campaign surfaced; 15 staging addresses). v2 issued 23 October 2026 (17 suspected source IPs; First Sight public edition). v3 issued 24 October 2026 (216-host target set; 21 scan-node addresses; this document).
FULL RULE TEXT · PLACE IN ONE .YAR FILE BEGINNING WITH THE IMPORT LINE
Place the rules in one .yar file that starts with the import line below, which the two hash-based rules require. Deployment notes and validation status are in Section 10.
import “hash”
rule PHP2Shell_SecondStage_ELF_SHA256
{
meta:
description = “Detects the PHP2Shell second-stage ELF x86-64 binary delivered by the observed loader”
author = “CYFIRMA Research”
date = “2026-10-22”
category = “Threat Intelligence”
severity = “High”
hash = “0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486”
source_note = “Single honeypot vendor, 21 Oct 2026; not independently corroborated”
scan_scope = “/tmp, /var/tmp, /dev/shm, web roots. The loader writes to /tmp and executes; the file may be deleted after launch”
condition:
uint32(0) == 0x464C457F and
filesize == 179632 and
hash.sha256(0, filesize) == “0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486”
}
rule PHP2Shell_Captured_Request_Body_SHA256
{
meta:
description = “Matches saved PHP2Shell scanner and OOM-tool HTTP request bodies by SHA-256”
author = “CYFIRMA Research”
date = “2026-10-22”
category = “Threat Intelligence”
severity = “Medium”
note = “Hashes of HTTP request bodies, not files. Matches only a body extracted byte-for-byte (PCAP, WAF or proxy capture); any change to boundary or field values changes the hash. A.4 is the durable alternative”
condition:
filesize < 2MB and
(
hash.sha256(0, filesize) == “43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a” or
hash.sha256(0, filesize) == “7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6”
)
}
rule PHP2Shell_Infrastructure_IPs_In_Content
{
meta:
description = “Finds PHP2Shell-associated IPs (six anonymisation-network IPs, three scanner/exploitation IPs and one payload staging host) in logs and other text content”
author = “CYFIRMA Research”
date = “2026-10-22”
category = “Threat Intelligence”
severity = “Medium”
note = “ip1 to ip6 are shared anonymisation infrastructure; ip7 is the second-stage staging host; ip8 to ip10 were reported by a second sensor network (ip8 and ip9 scanning with the php2shell-scan user-agent, ip10 attempting both CVEs). A hit means investigate, not confirmed compromise. String matching only; not network connection detection. Will also match threat-intel feeds and exit-node lists stored on disk”
strings:
$ip1 = “103.216.220.92” ascii wide fullword
$ip2 = “31.223.184.166” ascii wide fullword
$ip3 = “37.19.200.5” ascii wide fullword
$ip4 = “134.209.159.64” ascii wide fullword
$ip5 = “103.114.163.188” ascii wide fullword
$ip6 = “95.217.98.37” ascii wide fullword
$ip7 = “92.118.112.100” ascii wide fullword
$ip8 = “85.11.167.243” ascii wide fullword
$ip9 = “45.198.224.169” ascii wide fullword
$ip10 = “109.71.252.97” ascii wide fullword
condition:
any of them
}
rule PHP2Shell_Request_Shape_In_Capture
{
meta:
description = “PHP2Shell scanner/PoC strings or exploit request shape in captured HTTP requests”
author = “CYFIRMA Research”
date = “2026-10-22”
category = “Threat Hunting”
severity = “Medium”
scan_scope = “Per-request captures: ModSecurity audit log entries, WAF/proxy body dumps, PCAP-extracted bodies. Counts aggregate across the whole file, so do not run the shape branch on multi-request logs”
note = “UA, boundary and marker strings come from honeypot and community reporting of public tooling and are trivially changed. JACKALPOC in a captured response (not request) indicates the validation command ran. The upload-progress field name is configurable (session.upload_progress.name)”
strings:
$ua1 = “php2shell-scan” ascii nocase
$ua2 = “php2shell-verify” ascii nocase
$ua3 = /php2shell-1096[0-9]{2}/ ascii nocase
$bnd1 = “—-p2s” ascii
$bnd2 = “B7kQpoc619” ascii
$marker = “JACKALPOC” ascii
$field = “PHP_SESSION_UPLOAD_PROGRESS” ascii
$empty_file = “filename=\”\”” ascii
$array_part = /name=”[A-Za-z0-9_]{1,32}\[\]”/ ascii
condition:
filesize < 20MB and
(
any of ($ua*, $bnd*, $marker) or
($field and #empty_file >= 10) or
($field and #array_part >= 100)
)
}
rule PHP2Shell_Log_Crash_Signatures
{
meta:
description = “PHP error-log and PHP-FPM log lines consistent with PHP2Shell trigger attempts (pre-request OOM, session decode failure, worker segfault)”
author = “CYFIRMA Research”
date = “2026-10-22”
category = “Threat Hunting”
severity = “Low”
note = “Side-effect indicators, not proof of exploitation. Derived from community lab testing (largely PHP CLI server; nginx/FPM/Apache mappings provisional). Correlate with multipart POSTs from the same source. A memory-limit fatal with memory_limit=-1 set is a strong signal”
strings:
$oom = /Allowed memory size of [0-9]{1,12} bytes exhausted[^\n]{0,200} in Unknown on line 0/ ascii
$decode = “Failed to decode session object” ascii
$segv = “exited on signal 11 (SIGSEGV)” ascii
condition:
$oom or ($decode and $segv)
}
rule PHP2Shell_Session_File_Anomaly
{
meta:
description = “PHP session file containing PHP code or a residual upload-progress entry with an empty-filename spray”
author = “CYFIRMA Research”
date = “2026-10-22”
category = “Threat Hunting”
severity = “Medium”
scan_scope = “Session save_path, e.g. /var/lib/php/sessions or /tmp (sess_* files)”
note = “Branch A (PHP code) covers webshell staging via a poisoned session file, which the upload-progress feature makes possible. Branch B is unvalidated: upload-progress entries are normally removed on completion (session.upload_progress.cleanup=On), so a residual entry with many empty filenames is an anomaly worth review. Prefix is configurable (session.upload_progress.prefix). Covers php, php_serialize and php_binary handlers. Branch A can match applications that keep code snippets in session data”
strings:
$prefix = “upload_progress_” ascii
$php1 = “= 10)
)
}
rule PHP_Webshell_Input_To_Exec_Heuristic
{
meta:
description = “PHP files that pass request input to command execution or code evaluation, use an execution function as a string callback, evaluate the raw request body, or open a reverse shell”
author = “CYFIRMA Research”
date = “2026-10-22”
category = “Behavioural Detection”
severity = “Medium”
note = “Post-exploitation webshell detection in web roots; not PHP2Shell-specific. Validate hits against legitimate application code”
strings:
$php1 = “:$](system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec|assert|eval)\s*\(\s*((base64_decode|str_rot13|gzinflate|gzuncompress|rawurldecode)\s*\(\s*)*\$_(GET|POST|REQUEST|COOKIE|SERVER)/ nocase
// backtick operator executing request input
$backtick = /`[^`\n]{0,200}\$_(GET|POST|REQUEST|COOKIE)/
// variable function called with request input, e.g. $f($_REQUEST[‘x’])
$var_func = /\$[a-zA-Z_][a-zA-Z0-9_]*\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)\s*\[/
// request input used as the function name, e.g. $_GET[‘f’]($_GET[‘c’])
$input_func = /\$_(GET|POST|REQUEST|COOKIE)\s*\[[^\]\n]{1,40}\]\s*\(/
// execution function passed as a string callback, e.g. call_user_func(‘system’, …)
// (callback as first argument; method callbacks such as array($pdo, ‘exec’) are deliberately not matched)
$str_cb1 = /(call_user_func(_array)?|array_map|register_shutdown_function)\s*\(\s*[‘”](system|exec|shell_exec|passthru|popen|proc_open|assert)[‘”]/ nocase
// (callback as second argument after an array variable)
$str_cb2 = /(array_filter|array_walk|usort|uasort|uksort)\s*\(\s*\$[A-Za-z0-9_]{1,40}\s*,\s*[‘”](system|exec|shell_exec|passthru|popen|proc_open|assert)[‘”]/ nocase
// raw request body evaluated or included
$php_input = /(eval|assert|include|include_once|require|require_once)\s*\(?\s*(file_get_contents\s*\(\s*)?[‘”]php:\/\/input/ nocase
// reverse shell: socket plus interactive shell
$fsock = /fsockopen\s*\(/ nocase
$shell_i = /\/bin\/(ba)?sh -i|\/dev\/tcp\//
condition:
filesize < 1MB and
any of ($php*) and
(
$direct or $backtick or $var_func or $input_func or $str_cb1 or $str_cb2 or $php_input or
($fsock and $shell_i)
)
}
rule PHP_Suspicious_Command_Execution_Hunting
{
meta:
description = "Broad hunting rule for PHP files combining command execution with shell paths, request input or decoding"
author = "CYFIRMA Research"
date = "2026-10-22"
category = "Threat Hunting"
severity = "Low"
note = "Hunting only, not for alerting or blocking; expect false positives. Triage hits by location in the web root, ownership by the web-server or PHP worker account, and creation or modification on or after 17 Oct 2026"
strings:
$php1 = "exec, ::exec), variables ($exec) and longer names (curl_exec, filesystem)
$exec1 = /[^A-Za-z0-9_>:$]shell_exec\s*\(/ nocase
$exec2 = /[^A-Za-z0-9_>:$]proc_open\s*\(/ nocase
$exec3 = /[^A-Za-z0-9_>:$]popen\s*\(/ nocase
$exec4 = /[^A-Za-z0-9_>:$]passthru\s*\(/ nocase
$exec5 = /[^A-Za-z0-9_>:$]system\s*\(/ nocase
$exec6 = /[^A-Za-z0-9_>:$]exec\s*\(/ nocase
$exec7 = /[^A-Za-z0-9_>:$]pcntl_exec\s*\(/ nocase
$shell1 = “/bin/sh” ascii
$shell2 = “/bin/bash” ascii
$shell3 = “sh -c” ascii nocase
$in1 = “$_GET[” ascii
$in2 = “$_POST[” ascii
$in3 = “$_REQUEST[” ascii
$in4 = “$_COOKIE[” ascii
$decode1 = /[^A-Za-z0-9_>:$]base64_decode\s*\(/ nocase
$decode2 = /[^A-Za-z0-9_>:$]eval\s*\(/ nocase
$decode3 = /[^A-Za-z0-9_>:$](gzinflate|gzuncompress|str_rot13)\s*\(/ nocase
condition:
filesize < 5MB and
any of ($php*) and
(
(2 of ($exec*) and 1 of ($shell*)) or
(1 of ($exec*) and 1 of ($shell*) and 1 of ($in*)) or
(1 of ($exec*) and 1 of ($decode*) and 1 of ($in*)) or
// small file calling an execution function with request input anywhere (indirect webshells, e.g. $c=$_GET['c']; system($c);)
(filesize < 8KB and 1 of ($exec*) and 1 of ($in*)) or
// small file evaluating decoded request input indirectly, e.g. $p=base64_decode($_POST['p']); eval($p);
(filesize < 8KB and $decode2 and 1 of ($decode1, $decode3) and 1 of ($in*))
)
}
rule PHP2Shell_Public_PoC_Script
{
meta:
description = "Scripts that reference PHP2Shell CVEs or tooling strings together with the upload-progress field"
author = "CYFIRMA Research"
date = "2026-10-22"
category = "Threat Hunting"
severity = "Low"
note = "Finds staged exploit tooling on compromised hosts or analyst systems. Security firms warned that circulating PoCs may contain malware; treat hits on analyst systems as possible infection too. Matches detection-content files holding the same strings; exclude rule repositories"
strings:
$field = "PHP_SESSION_UPLOAD_PROGRESS" ascii wide
$t1 = "php2shell" ascii wide nocase
$t2 = "CVE-2026-109618" ascii wide nocase
$t3 = "CVE-2026-109619" ascii wide nocase
$t4 = "B7kQpoc619" ascii wide
$t5 = "JACKALPOC" ascii wide
$code1 = "import requests" ascii
$code2 = "requests.post" ascii
$code3 = "socket.socket" ascii
$code4 = "curl_init" ascii
condition:
filesize < 1MB and
uint32(0) != 0x464C457F and
$field and
1 of ($t*) and
1 of ($code*)
}
