---
title: North Korean-linked hackers prepare targeted attacks using PHP2Shell vulnerability
url: https://www.dataloco.com/en/north-korean-linked-hackers-prepare-targeted-attacks-using-php2shell-vulnerability
published: 2026-10-26T19:21:14+00:00
language: en
section: Security
source: https://www.dailysecu.com/news/articleView.html?idxno=209035
organizations: CYFIRMA, PHP, PHP2Shell
publisher: Dataloco
---

# North Korean-linked hackers prepare targeted attacks using PHP2Shell vulnerability

A hacking group suspected of ties to North Korea is preparing to exploit the recently disclosed PHP2Shell vulnerability to target government agencies and financial institutions in South Korea and other major countries. No direct evidence has been obtained to confirm the group's North Korean affiliation, and the success of any actual attacks remains unverified.

Global cyber threat intelligence firm CYFIRMA reported on October 23 that a Korean-speaking attacker is using private communication networks to select targets and collect and verify public attack code for the PHP2Shell vulnerability. The firm tracks this activity as the June 2026 Minjun campaign. The attacker is identifying vulnerable PHP servers by country and industry on the I2P anonymous network and discussing plans to use verified code in real attacks. Evidence suggests the attacker is also using artificial intelligence to evaluate the potential of public attack code.

Target candidates include South Korea, the United States, Japan, Taiwan, Thailand, Indonesia, India, Singapore, Australia, the United Arab Emirates, Saudi Arabia, and European Union member states. Government agencies and banks are the top priorities, with manufacturing, logistics, aviation, online trading platforms, trade, and construction also listed as targets. CYFIRMA stated that 15 pieces of infrastructure information were shared on private channels during the preparation phase. The attackers plan to finalize a first-round target list by October 25, but the specific attack start date and target server list are unknown.

CYFIRMA identified 17 additional suspicious IP addresses on October 23 during an eight-hour period of activity attempting to exploit PHP web shells and file upload functions. A web shell is a malicious program that allows an attacker to remotely execute commands or manipulate files on a compromised web server. If the PHP2Shell vulnerability is exploited, the damage could expand to data theft and the installation of additional malware. However, no evidence links these 17 IP addresses to the Korean-speaking attacker's infrastructure. CYFIRMA noted that the activity is similar to the expected attack method but cannot be definitively attributed to the same group.

The North Korean link is still under analysis. CYFIRMA assigned high confidence to the existence of the attack plan and preparation activities but rated the connection to the North Korean hacking group Lazarus at medium confidence. The use of Korean and similar attack methods are not sufficient to confirm the attacker's identity.

PHP2Shell refers to vulnerabilities CVE-2026-109618 and CVE-2026-109619 in the PHP execution engine. Both have a risk score of 9.2, allowing an attacker to execute malicious commands on a web server without authentication in certain environments. Because the vulnerability is in the PHP engine itself, updating website management programs like WordPress is insufficient. CYFIRMA recommends updating to patched versions PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting the PHP process. Servers that cannot be patched immediately should restrict external access and check for suspicious web requests, malicious file creation, and abnormal command execution since October 17. This analysis shows PHP2Shell could be used for targeted attacks against specific countries and industries, but no successful compromises of South Korean companies or public institutions have been confirmed.

## This story in other languages

- [Italiano](https://www.dataloco.com/it/un-gruppo-di-hacker-sospettato-di-legami-con-la-corea-del-nord-prepara-attacchi-tramite-php2shell)