CYFIRMA: Korean-speaking hackers prep PHP2Shell attacks, Lazarus link probed
CYFIRMA says the actors discussed targets in South Korea, the US, Japan and the EU, and used AI models to sort exploit code before testing it.
Singapore-based cybersecurity company CYFIRMA reported on October 24, 2026 that Korean-speaking members of the closed anonymity network I2P have been discussing planned cyberattacks that exploit the PHP vulnerability known as PHP2Shell (CVE-2026-109618, CVE-2026-109619), according to etnews.com.
CYFIRMA said the discussed targets included government agencies, banks and other financial institutions, manufacturing, logistics and shipping, airports and aviation, online trading platforms, trading companies and construction firms. The regions named in the discussions included South Korea, the US, Japan, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia and the EU.
The actors reportedly used AI models to prioritize collected proof-of-concept exploit code and validated it in a controlled environment before use.
CYFIRMA named the activity the "June 2026 Minjun" campaign and rated the confidence of a link to North Korea's Lazarus Group as moderate.
Earlier patching and advisory work
On October 21, 2026, the PHP development team released a security update fixing the vulnerability. A day later, South Korea's Ministry of Science and ICT and the Korean Internet & Security Agency (KISA) issued a "caution" alert on the vulnerability and advised companies on countermeasures.
Quick answers
What is PHP2Shell?
PHP2Shell is a PHP vulnerability tracked as CVE-2026-109618 and CVE-2026-109619. A PHP security update released on October 21, 2026 fixes it.
Which targets were discussed?
According to CYFIRMA, the actors discussed government agencies, banks and other financial institutions, manufacturing, logistics and shipping, airports and aviation, online trading platforms, trading companies and construction firms.
Is the Lazarus Group confirmed to be behind the campaign?
No. CYFIRMA rated the confidence of a link to North Korea's Lazarus Group as moderate.