Evidence has emerged that a large-scale cyberattack targeting government agencies and financial companies is being prepared by exploiting a critical flaw in PHP, the server-side programming language used by a large share of websites worldwide. The disclosure that the actors behind the plot coordinated their operations in Korean on a closed anonymous network has raised the possibility of involvement by a North Korea-backed group.
Singapore-based cybersecurity firm CYFIRMA said it confirmed signs that Korean-speaking users on the closed anonymous network I2P were discussing attack plans exploiting the PHP vulnerabilities “PHP2Shell” (CVE-2026-109618, CVE-2026-109619). The activity is being tracked as the “June 2026 Minjun” campaign, named after the channel. The attack preparations were detected on the 22nd, and no actual compromises have been confirmed.
The flaw allows hackers to execute remote commands on a server using only crafted web requests, without separate authentication. On the Common Vulnerability Scoring System (CVSS), it rates 9.2 out of 10, placing it in the “critical” category. CYFIRMA described the case as the first it has observed in which attackers deliberately targeted PHP2Shell with government and financial institutions as priority targets, and rated the severity as “very high.”
The attack plans listed government agencies and banks and financial firms across South Korea, the United States, Japan, Australia, Taiwan, India, Singapore, Thailand, Indonesia, the United Arab Emirates (UAE), Saudi Arabia and the entire European Union as top-priority targets. Manufacturing, logistics and shipping, airports and aviation, online trading platforms, trading companies and construction firms were also included. A specific attack start date and a confirmed target list have not yet been identified.
The preparations also showed signs of artificial intelligence (AI) use. The actors were found to have collected publicly available proof-of-concept (PoC) exploit code, used their own AI models to set attack priorities, and run pre-attack simulation validation in controlled environments. A day later, on the 23rd, CYFIRMA identified 17 additional attack-origin IP addresses in activity suspected of involving the use of remote server-control tools or the exploitation of information during file uploads, but said those addresses alone are difficult to link directly to the North Korea-linked channel.
Views on the culprits remain cautious. CYFIRMA raised the possibility that the operator is linked to North Korea’s Lazarus Group but rated its confidence only as “medium.” The evidence cited includes attack instructions issued in Korean, the selection of government and financial institutions as core targets, and tactics similar to the WebShell methods Lazarus has favored in the past. On the other hand, critics note that no direct evidence has been confirmed, such as overlapping Lazarus-specific malware or fixed infrastructure. One security expert said it is difficult to independently verify North Korean involvement from public data alone, and that it would be appropriate to respond first to the risk of the vulnerability itself and the signs of attack attempts while classifying any judgment on the culprits as information requiring further verification.
The exposure is considerable. About 69.3% of websites currently use PHP. Of those, any organization running a version below PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 is vulnerable. Environments that run PHP programs directly on Apache web servers are especially exposed and require particular caution.
In South Korea, the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) issued a “caution” alert for the vulnerability on the 22nd and distributed security response guidelines to companies and institutions. The PHP development team also released an emergency patch fixing the flaw on the 21st. CYFIRMA recommended completing patch application and server restarts, then detecting threats from the 17th onward.
CategoryDetailsVulnerabilityPHP2Shell (CVE-2026-109618, CVE-2026-109619)SeverityCVSS 9.2 (critical), severity “very high”Vulnerable versionsBelow PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35Share of websites using PHPAbout 69.3%Main targetsGovernment agencies, banks, financial institutions (top priority); manufacturing, logistics, shipping, aviation, online trading, trade, constructionRegions targetedSouth Korea, US, Japan, Australia, Taiwan, India, Singapore, Thailand, Indonesia, UAE, Saudi Arabia, EUResponsePHP emergency patch on the 21st; Ministry of Science and ICT and KISA “caution” alert on the 22nd
Note: Based on CYFIRMA’s threat warning and announcements by South Korean authorities.
The implication of this case is that the targets are not individual companies but infrastructure directly tied to national functions. If government agencies and financial networks are targeted simultaneously, the consequences could go beyond service disruptions to data leaks and follow-on financial theft. CYFIRMA said Lazarus-linked groups pursue both financial gain and intelligence gathering, and that a successful server intrusion could allow them to hand access to other hackers, steal virtual assets, prepare ransomware attacks or extract account credentials. The possibility of lingering in systems for extended periods to collect confidential information cannot be ruled out.
Given the broad scope, the speed of patch adoption is key. Organizations operating web servers should immediately check their PHP versions and apply the latest security updates. Experts advise that even after patching, organizations should check for signs of compromise and monitor access logs in parallel.
Click Here For The Original Source.
——————————————————–
