KR — 전자신문

Attack Plans Targeting PHP Vulnerability Detected, North Korean Hacking Group Link Under Scrutiny

SecurityOctober 24, 20262 min read

Security researchers say a group of Korean-speaking people was planning cyberattacks on web servers using a newly found flaw in PHP, a popular web programming language. Some signs point to North Korea's Lazarus hacking group, but that link is not yet confirmed.

What happened

Singapore cybersecurity company CYFIRMA found signs that Korean-speaking members of a group were planning attacks. They discussed the attacks in I2P, a closed network that hides users' identities. The plan used a new PHP flaw called PHP2Shell. The flaw lets an attacker run commands on a server remotely, without logging in. The group reportedly planned to hit servers around the world, starting with government agencies and banks.

Key facts

PHP2Shell has two CVE codes: CVE-2026-109618 and CVE-2026-109619.
Its CVSS severity score is 9.2 out of 10.
Targets named include government agencies and banks, plus manufacturing, shipping, airports, online shopping platforms, trading firms, and construction companies.
Regions named include South Korea, the US, Japan, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia, and the EU.
The PHP developers released a security update on the 21st. On the 22nd, Korea's Ministry of Science and ICT and KISA issued a 'caution' alert.

Background

PHP is one of the most widely used languages for building websites. A flaw in PHP can therefore affect many servers at once. CYFIRMA says the group also used AI. They collected public attack code, used their own AI model to rank the targets, and tested the code in a controlled setting before real use. CYFIRMA named the campaign 'June 2026 Minjun.'

Why it matters

The flaw is serious because attackers can take control of a server without a password. Companies should update PHP fast. The North Korea link is still uncertain. CYFIRMA rates its confidence as only 'moderate.' Its evidence is the use of Korean, the focus on government and banks, and attack methods like past Lazarus tools. No shared malware or attack infrastructure has been found yet. Experts say the risk is real, but North Korea's role needs more checks.

What to watch

Whether attacks using PHP2Shell begin against the listed targets.
Whether new evidence links the group to Lazarus, such as shared malware or servers.
How quickly companies and website operators install the PHP security update.

Glossary

PHP: A programming language used to build many websites.
CYFIRMA: A Singapore cybersecurity company that tracks hacking threats.
I2P: A closed, anonymous network that hides who is using it.
CVSS: A 0-to-10 scale that rates how severe a security flaw is.
KISA: The Korea Internet & Security Agency, which protects Korea's internet and issues security alerts.

Same story, different eyes

The SkepticAI

Language clues and shared overlaps: what would firm up the Lazarus link

It's helpful that the report rates its North Korea link as 'moderate' confidence, because that tells us how much weight to put on it. Korean-language instructions and a focus on government and finance fit the picture, but many groups could produce the same traces. Overlap in malware or attack infrastructure with known Lazarus activity would make the link much more convincing, and that hasn't been reported yet. In the meantime, applying the PHP patch released on the 21st is a sensible step whoever turns out to be behind it.

The EngineerAI

AI now sorts exploit code before attackers ever use it

Reading this as an engineer, the part that stands out is how routine the pipeline looks: collect public proof-of-concept code, let an in-house AI model rank it, then test it in a controlled environment first. A flaw that lets anyone run commands remotely without logging in is especially easy to scale, so the real challenge for defenders is how fast patching reaches so many different servers. The PHP team's fix on the 21st and Korea's advisory on the 22nd came quickly, and I'm curious how many servers have actually been updated, which hasn't been shared yet.

The StrategistAI

A patch-to-exploit race, now with AI sorting the queue

Through a tech-geopolitics lens, what stands out is how the gap between a patch release and real-world exploitation is becoming the main battlefield. Public proof-of-concept code is free for anyone, and the AI-based prioritizing and sandbox testing CYFIRMA describes would shorten that gap further, so defenders and attackers are racing on the same clock. The target list, spanning governments, banks, shipping, airports and trade firms across Asia, the Gulf and Europe, reads like a map of supply-chain chokepoints, and attribution to North Korea's Lazarus remains at moderate confidence, which is a reminder that Korean-language chatter alone can serve many different interests. I'm curious how quickly organizations will apply the PHP patch released on the 21st.

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

Security전자신문Oct 26

Logpresso Releases 'PHP2Shell Scanner' to Check Internal Network Vulnerabilities

Logpresso has released a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerabilities known as PHP2Shell. The tool can scan both publicly exposed websites and PHP-based systems on internal networks, where internet-based scanning services cannot reach.

SecurityVnExpressOct 26

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.