Ethical Hacking News
A suspected North Korean campaign has been identified as the target of a PHP2Shell vulnerability, which affects 216 vulnerable PHP hosts. The vulnerability, which was disclosed on October 21, 2026, can be exploited remotely by sending specially crafted HTTP requests. Organizations and individuals are advised to patch their hosts as soon as possible, and to be vigilant in detecting and responding to this exploit.
The PHP2Shell vulnerability has been identified as a potential security risk, affecting 216 vulnerable PHP hosts. The attackers are believed to be a group linked to the Lazarus family of North Korean groups. The vulnerability can be exploited remotely by sending specially crafted HTTP requests. Emergency patches for the two critical vulnerabilities have been released by the PHP project. Users who cannot patch their hosts yet are advised to apply limits to prevent the exploit. Patching is the most effective way to prevent the exploit, and keeping software up to date is crucial.
The PHP2Shell vulnerability has been identified as a potential security risk, with 216 vulnerable PHP hosts being targeted by a suspected North Korean campaign. The vulnerability, which was disclosed on October 21, 2026, affects all PHP versions that handle web requests, and can be exploited remotely by sending specially crafted HTTP requests.
The attackers, who are believed to be a group linked to the Lazarus family of North Korean groups, have been using a local AI model to rank public exploit repositories, and then test the results manually in a lab. The group has identified 216 hosts that may still be vulnerable to PHP2Shell, and are planning to check all of these hosts, select the most promising targets, and decide which publicly available exploits to adapt.
Cyfirma, a cybersecurity firm, has assessed the situation with moderate confidence, based on language, operating style, and old habits with PHP web shells and hijacked web servers. They believe that the group is not developing new exploits, but rather using the public exploit repositories to turn newly disclosed vulnerabilities into working attacks.
The vulnerability, which has a CVSS score of 9.2, can be exploited by sending specially crafted HTTP requests to the vulnerable PHP hosts. The attackers can execute code remotely, without authentication, and can also crash the PHP process or leak memory.
The PHP project has released emergency patches for the two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which affect all PHP versions that handle web requests. The patches are available for download, and users are advised to apply them as soon as possible.
Cyfirma has provided a list of 21 scan-node addresses, 17 source addresses from October 23, and 15 staging addresses, all of which are defanged. They have also provided a list of 17 sigma rules and 15 YARA rules, which can be used to detect the exploit.
Users who cannot patch their hosts yet are advised to apply the following limits: a low post_max_size and disabling session upload progress for 109619. However, Cyfirma emphasizes that patching is still the most effective way to prevent the exploit.
The operators' own selection rule is the most useful detail in the whole advisory, because they dropped every host that showed a fixed version or sat behind heavy filtering. This makes a current version string a cheap filter against you, and for once being boring pays off.
The PHP2Shell vulnerability highlights the importance of keeping software up to date, and the need for organizations to prioritize their security. It also underscores the threat posed by nation-state actors, who are using sophisticated tactics and techniques to exploit vulnerabilities.
In conclusion, the PHP2Shell vulnerability is a serious security risk that should not be taken lightly. Organizations and individuals should take immediate action to patch their hosts, and to be vigilant in detecting and responding to this exploit.
Related Information:
https://www.ethicalhackingnews.com/articles/The-PHP2Shell-Vulnerability-A-Suspected-North-Korean-Campaign-Targets-216-Vulnerable-PHP-Hosts-ehn.shtml
https://securityaffairs.com/201748/hacking/php2shell-suspected-north-korean-campaign-targets-216-vulnerable-php-hosts.html
Published: Mon Oct 26 14:07:47 2026 by llama3.2 3B Q4_K_M
