North Koreans Tied to Active Scanning for Critical Vulnerabilities in PHP
Mathew J. Schwartz (euroinfosec) •
October 27, 2026
Image: Shutterstock
America’s cybersecurity agency has confirmed that recently revealed critical vulnerabilities in PHP are being exploited in the wild.See Also: 79% of SOCs Use AI. Only 36% Have It in Their Workflows.
The U.S. Cybersecurity and Infrastructure Security Agency on Monday added the PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog. The flaws can be remotely exploited by attackers to seize control of affected servers.
The agency set a Thursday deadline for all federal civilian agencies to either patch the flaws or take affected systems offline. “These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise,” CISA said in a Monday alert.
To address the vulnerabilities, the PHP Foundation on Wednesday released four patched updates: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (see: Critical PHP Patches Address ‘Very, Very Bad Vulnerability’).
“Apply the patch immediately, prioritizing internet-facing systems,” CISA recommended to all PHP users. “Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated,” it said.
Both of the flaws also require “forensic triage,” per Binding Operational Directive 26-04, “Prioritizing Security Updates Based on Risk,” CISA said. This requires federal civilian agencies to not only mitigate affected systems within three days, but also to “carry out a forensic triage of the asset to assess whether the system is compromised.”
The agency’s alert follows millions of scans for the flaws since they were patched Wednesday and the appearance of hundreds of proof-of-concept exploits, with many confirmed to be of vibe-coded origin and to not work. But in recent days, honeypots run by multiple organizations have found in-the-wild exploits that do appear to be successful at exploiting PHP2Shell to gain root-level access to servers running various versions of PHP.
Further proof came in the form of a “Steal My Bitcoin” capture the flag contest launched Saturday, with a cryptocurrency wallet address waiting for anyone who could exploit the flaw in PHP version 8.4.26. A British vulnerability tester claimed the prize just 19 hours later, and has published his proof-of-concept code to GitHub (see: Honeypots Now Recording in-the-Wild PHP2Shell Exploits).
PHP2Shell flaw comprises the PHP memory corruption vulnerability CVE-2026-109618 and the PHP stale internal request-state vulnerability CVE-2026-109619. Both of the flaws carry a CVSS v4 rating of 9.2.
An overview of the flaws published by threat intelligence firm watchTowr says: “CVE-2026-109618 is triggered when PHP runs out of memory partway through setting up a request, leaving internal data half built for the cleanup code to trust. CVE-2026-109619 comes from internal state that outlives the request memory it points to, so the next request that the same PHP worker picks up can act on that leftover data. Both are rated CVSS v4.0 9.2.”
“The vulnerabilities affect all PHP installations serving web requests, including Apache with mod_php (note: PHP considers this highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed,” CISA said.
Security experts said hacking PHP2Shell might require exploits to be tuned to every different version of PHP, rather than a single piece of exploit code working “as is” against them all. Further mitigating factors may include web application firewalls, endpoint security tools, exploit detection systems and other defenses, including systems that provides address space layout randomization, or ASLR, which makes exploiting the vulnerabilities more difficult. But not all software and products running PHP – including older technology – have ASLR or enable it by default.
Major Vendors Detail Exposure
One challenge with PHP is that it’s often built into different products, including networking gear, security appliances and internet of things devices. As CISA noted: “PHP is often a component of other software and prevalence may not be directly observable.”
Multiple security vendors have said they’re reviewing their products for the presence of PHP and prepping required fixes. This includes Palo Alto Networks, which has sped up its planned release of patches.
Cisco on Monday issued an update to its own product review, which now lists a swath of unaffected products.
The technology giant still has a handful of products it’s continuing to assess. So far, it’s issued patches for affected Expressway Series devices, as well as Duo Access Gateway products, which went end-of-life in 2023 except for federal customers. A patch for the also affected Ultra-Reliable Wireless Backhaul isn’t due until February 2027, but Cisco has released mitigation advice and said PHP2Shell can only be exploited on the devices if an attacker already has admin-level access.
Fortinet has confirmed that the vast majority of its products are not affected, including FortiOS, the operating system that runs its FortiGate products, as well as FortiManager, FortiAnalyzer and FortiWeb. The company is continuing to assess just a handful of additional products to see if they’re at risk from PHP2Shell, including FortiDDoS and FortiSOAR.
Scans Reveal North Korean Probes
Interest in PHP2Shell continues to mount, including from some predictable sources. Cybersecurity firm Cyfirma said Thursday it identified activity tied to “Korean-speaking operators” who it suspects are state-sponsored hackers tied to the murderous dictatorship that governs North Korea, aka the Democratic People’s Republic of Korea.
By Friday, the attackers “moved from reconnaissance into active, low-and-slow scanning of a filtered target set” comprising 216 hosts, “running low-and-slow PHP weakness checks from 21 compromised nodes against CVE-2026-109618 and CVE-2026-109619,” it said.
The activity appears to be tied to the DPRK threat actor codenamed Lazarus Group, although Cyfirma said that assessment is based on “behavioral and linguistic indicators rather than infrastructure or malware-family overlap.”
Government agencies, financial services firms, online trading platforms, plus manufacturing, logistics, shipping and construction organizations across the United States, parts of Asia – India, Indonesia, Japan, Singapore, South Korea, Taiwan, Thailand – as well as Australia, Saudi Arabia, the United Arab Emirates and the European Union comprise the target list.
“Organizations in the prioritized sectors and geographies should assume they are in scope for deliberate targeting,” Cyfirma said.
If the Lazarus Group is at work, a range of attacks may result. “The Lazarus ecosystem’s dual financial-and-espionage mandate means access gained here could feed initial-access resale, cryptocurrency theft, ransomware precursors, credential theft and long-term espionage,” it said.
CISA hasn’t confirmed any cases yet of PHP2Shell being used so far to unleash ransomware inside a victim’s organization.
——————————————————-
Click Here For The Original Source.
