PHP2Shell DPRK Campaign: 216 Hosts, No Named Victims

On 24 October 2026 CYFIRMA published Version 3 of a critical pre-attack notification on the PHP2Shell DPRK campaign. A Korean-speaking, DPRK-nexus set it links to the Lazarus ecosystem has kept 216 internet-facing PHP hosts that still advertise older PHP. No launch date, named organization or mass compromise by this actor is in the note.

What did CYFIRMA warn about in the PHP2Shell DPRK campaign?

The PHP2Shell DPRK campaign in CYFIRMA Version 3 is an early-warning advisory CYFIRMA says it updates as new versions ship. It is not a victim announcement. The header reads “24 OCTOBER 2026 · GLOBAL · PRE-ATTACK NOTIFICATION”, marked Version 3 and CRITICAL. Industry, Technology, Geography, Threat Actor and Active in Past are all met.

The aggregator timestamp is 2026-10-26T07:59:33Z, two days after the advisory date. Operational claims are pinned to 24 October, including a filtered list reportedly ready at about 01:47. Neither stamp is the moment a named company was breached. CYFIRMA names none.

The imminence index is 78 out of 100, and Version 3 did not re-score it. CYFIRMA’s scale puts 90 at confirmed mass compromise. At 78 the source sees active low-and-slow scanning of a filtered set, a launch still plausible, and no proof this set has landed shells at scale. Handlers had stated no launch window as of 24 October. The next milestone is a refined shortlist of highest-confidence hosts, then a choice of which public approaches to adapt.

Treat every internet-facing PHP host below 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as exposed, and any host still advertising an older PHP version as a likely member of the operators’ 216-host target set.

That line instructs defenders. It does not mean CYFIRMA has your hostname. The 216-host spreadsheet, with sector and country tags and a column for scan results, sits at the operators’ collection point. CYFIRMA has not seen the sheet. No organization is identified.

Roughly one third of the 216, an estimate, had been touched by about 02:10 on 24 October. A full first pass and a tighter shortlist were expected later that day. Versions 1 and 2 had expected the first filtered list by 25 October, so the list landed a day early. This is scan progress, not a compromise count.

Between 21 and 23 October, opportunistic PHP2Shell exploit attempts against the same CVEs grew from a first recorded probe to millions of requests. Our earlier account of those PHP2Shell exploit attempts with no confirmed RCE records Cloudflare, Previdian, Sophos, Wordfence and others still reporting no confirmed remote code execution in that wave. Volume-only monitoring sees that spray and misses the short list.

Which PHP versions fix PHP2Shell, and which builds have no patch?

PHP2Shell is the label CYFIRMA uses for CVE-2026-109618 and CVE-2026-109619 together. Both score CVSS v4.0 9.2. Both are described as unauthenticated remote code execution in PHP core. The advisory does not describe the root cause of either bug. Act on the fixed versions, not on a guessed bug class.

Fixes shipped on 21 October 2026 for supported branches: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier have no official upstream fix. PHP 8.2 is the oldest branch on that list. A host on 8.1, 8.0, 7.4 or a 5.x build cannot reach a vendor fix by swapping application files. Move the engine, or take the service off the internet. Anything still advertising older PHP is what the operators kept after they dropped hosts that banner the fixed versions.

Branch	Status in this advisory
8.5.12, 8.4.27, 8.3.36, 8.2.35	Fixed on 21 October 2026
8.1 and earlier	No official upstream fix
Still advertising older PHP	Kept in the 216

Earliest known exploitation is 17 October 2026. Measured to the 24 October advisory date, that is a seven-day exposure window. The 26 October aggregator stamp does not move that window. Hunt back to 17 October. The hunt is due within 72 hours of the advisory, by 27 October. Use on the 17th through the 20th predates the 21 October fixes. A patch applied on the 22nd does not show whether the host was touched on those earlier days. Keep logs that cover them before workers restart.

Public exploit attempts were already in the millions by 22 October, while this set was still building a private list of hosts that had not moved. The claimed entry route is crafted multipart/form-data requests, with the highest success against Apache mod_php on the default prefork MPM. No request template is in the material. Prefork with mod_php runs PHP inside persistent Apache workers. PHP-FPM runs separate pools behind Apache, nginx or another front end. A reload that keeps old workers alive leaves stale state in place. A restart destroys CVE-2026-109619 state, so capture evidence on a suspect host before that restart. Isolate what you cannot patch within hours, with Apache mod_php first.

How did 216 hosts survive the filter, and why do financial platforms sit first?

The 216 hosts are filter survivors, reported ready at about 01:47 on 24 October during a channel exchange that ran to about 02:22. Hosts that banner the fixed PHP versions or that sit behind heavy filtering were dropped. The remaining 216 still advertise older PHP. An old banner means the host matched the keep-rule. It is not proof of exploitability.

PHP’s expose_php setting controls the X-Powered-By header. Administrators suppress or rewrite banners. Distributions backport fixes without changing the upstream version string. A host that still says 8.1 can be an unfixed engine, a silent backport or a false banner. A quiet host can be patched, or hidden and unpatched. The operators kept the hosts that still talked. That banner-and-reachability test is what external network penetration testing is built to answer: what the edge still advertises, and what heavy filtering already drops.

Twelve geographies were restated on 24 October: the United States, Japan, Thailand, Indonesia, South Korea, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia and the EU. Eight sectors sit in three tiers. Six are named: government, financial institutions, logistics, airports and aviation, manufacturing, and online transaction platforms. Government and financial services are first. Airports and aviation count as one named sector here. Two of the claimed eight are not spelled out. The sheet the operators tagged has not been seen, so a missing sector name stays a gap.

Cyprus is not named. The EU is. That is the link to Nicosia, Limassol and the licensed firms based there. Electronic money institutions and payment firms are financial institutions. Crypto-asset service providers that hold or move client assets sit in the same tier when the brand says exchange rather than bank. iGaming cashiers, wallets and player-account portals are online transaction platforms in the plain sense of the sector list. Scope follows an old internet-facing PHP banner and a path the filter did not drop.

CYFIRMA’s high-confidence judgment is Korean-speaking operators with a DPRK state-nexus. The Lazarus affiliation is moderate confidence and rests on language, operational pattern and historical tradecraft. The aliases listed are Lazarus, APT38, Hidden Cobra and ZINC / Diamond Sleet. Those names overlap in commercial and government reporting. They are not one org chart, and not one set of operators. APT38 is the label often tied to financially motivated theft against banks, payment rails and crypto platforms. Moderate confidence means the named-group fit is not locked. No victim organization is named, so no customer notice or regulatory filing follows from Version 3 alone.

Version 3 puts online transaction platforms in the sector list and the EU in the geography list. It publishes no gambling-sector count, no Cyprus row and no stolen-funds total. Clocks under a DORA TLPT engagement start after an incident is classified, not when a scan appears in an advisory. The spreadsheet is tagged by sector and country so hosts can be ranked. Version 3 gives no theft total. Banner suppression can leave a vulnerable host off the 216 and still reachable.

What infrastructure and tradecraft did the source observe?

Weakness checks run from 21 compromised nodes, separate from staging and collection infrastructure. Operators confirmed the split at about 02:04 on 24 October. CYFIRMA observed those same addresses, in the eight hours before publication, performing PHP web-shell tooling and upload-progress session-poisoning attempts. That observation is CYFIRMA telemetry, distinct from the channel’s own claim. Some addresses may belong to other victims rather than to actor-owned servers.

Block or monitor 38 source addresses: the 21 Version 3 scan nodes plus the 17 Version 2 sources. Monitor and hunt the 15 IPv4 staging addresses shared in-channel. CYFIRMA published them defanged. They are not copied here. Load them from the advisory so a later update does not leave a stale second list in an article.

Scan nodes are not the staging or collection hosts. Pacing is low-and-slow, without broad noisy sweeps. Operators rotate the node list and log which addresses return the indicators they expect. A node that hits filtering or rate limits is marked, removed and not reused. CYFIRMA calls that burn discipline.

Coordination is a closed I2P channel monitored since 22 October 2026. Two handles have been active since March 2026. Names are redacted to forms like “전███ 2 (Je████████ 2)” and “최██ (C██████).” Those handles are sourcing detail. What you can find is contact from the scan-node set and multipart requests aimed at PHP. I2P egress is a leadership watch item. One quiet multipart request against an upload path is the shape of this activity.

Session upload progress is the first technique recorded on these nodes. Specially crafted multipart/form-data requests can poison session data and, under certain configurations, support code execution or session hijacking when that data is handled unsafely, or combined with local file inclusion. A matching request is a lead. It is not a shell. The second technique is PHP web-shell tooling on the same 24 October infrastructure, for remote code execution, persistence and post-exploitation. The advisory says the nodes were doing this. It does not say a named EU firm received a shell.

What should a security lead do before that shortlist becomes a launch?

Patch supported branches to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and fully restart every PHP worker, then hunt web and PHP logs back to 17 October 2026. As of 24 October no launch window had been stated. The shortlist was the next milestone. Hosts that still banner older PHP are the ones the operators kept, and they go first.

Restart means every process that executes PHP. On Apache prefork with mod_php, that is the Apache worker. A graceful reload can leave the old generation running. On PHP-FPM, restarting only nginx or the front-end Apache leaves the pool untouched. Containers, sidecars and autoscaled replicas each have their own workers. Verify by process start time and the package build that serves traffic, not by php -v in a shell on a different SAPI. A CLI binary on 8.3.36 can sit next to an FPM pool still serving a cashier vhost from an 8.1 image.

On a host you already suspect, preserve evidence before the restart. Take process trees, sockets, web and PHP logs, recent file changes, temporary and upload directories, and session storage. CYFIRMA warns a restart destroys CVE-2026-109619 state. Volatile memory goes with it.

Hunt prior contact with the published sources, multipart anomalies, worker crashes and shells spawned by PHP. The window opens at 17 October. The hunt is due within 72 hours, by 27 October. A blocklist of 38 addresses loaded later does not show what those addresses, or the Version 2 set, asked for last week. Unexpected session files and new PHP files in upload or cache directories matter more than a threshold that never fired. Low volume is the design.

• Inventory internet-facing vhosts and record Server API, banner and package build.
• Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or remove the host from the internet where no upstream fix exists.
• Restart every PHP worker and confirm the start time is after the package change.
• Block or monitor the 38 source addresses, and monitor the 15 staging addresses, from the advisory.
• Preserve evidence on suspect hosts before restart, because CVE-2026-109619 state is lost on restart.
• Hunt from 17 October for those addresses, multipart anomalies, worker crashes and PHP-spawned shells.
• Brief leadership by 31 October with imminence at 78 out of 100, not at the mass-compromise mark of 90.

Notify CERTs and brief leadership on the advisory’s seven-day item, due 31 October. Watch the published infrastructure, I2P egress, a launch statement and the refined shortlist. Hand them 78 out of 100, with 90 defined as confirmed mass compromise, and note that Version 3 did not re-score it.

After the patch and the log hunt, web application penetration testing checks whether upload handlers, role paths and the live Server API match the package you think you shipped.

FAQ

What is the PHP2Shell DPRK campaign?

CYFIRMA's Version 3 pre-attack notification, dated 24 October 2026, describes a Korean-speaking, DPRK-nexus set filtering internet-facing PHP for PHP2Shell. The set reported 216 hosts that still advertise older PHP. No launch date and no named victim are in the note.

Are CVE-2026-109618 and CVE-2026-109619 being exploited?

CYFIRMA sets the earliest known exploitation at 17 October 2026 and says this set was running low-and-slow weakness checks by 24 October. It does not confirm mass compromise. A separate 21–23 October probe wave reached millions of attempts with no confirmed shell.

Which PHP versions fix PHP2Shell, and does PHP 8.1 have a patch?

Fixes shipped on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both CVEs are CVSS v4.0 9.2. No official upstream fix exists for PHP 8.1 or earlier. Restart every worker after the package change. A reload can leave old code running.

How many hosts are on the list, and is mass compromise confirmed?

Operators reported 216 hosts ready at about 01:47 on 24 October. About one third, an estimate, had been touched by 02:10. CYFIRMA has not seen the spreadsheet. Imminence stays at 78 out of 100, under the 90 mark used for confirmed mass compromise, and Version 3 did not re-score it.

If your cashier, wallet or KYC upload path is still on PHP, a scoped test will show whether the worker you restarted is the worker that faces the internet. agent::offense runs that check as web application penetration testing and, for in-scope financial entities, maps the same finding into a DORA threat-led exercise.