Suspected Lazarus-Linked Campaign Targets Critical PHP Flaws
Cybersecurity researchers have detected preparations for attacks exploiting two critical PHP vulnerabilities, with governments, banks and other infrastructure operators reportedly among the priority targets. The possible link to North Korea's Lazarus Group remains unconfirmed.
Cybersecurity researchers have detected signs that a threat group may be preparing a broad campaign against web servers using recently disclosed flaws in PHP, a programming language that underpins a large share of websites worldwide. South Korea is reportedly among the countries identified as priority targets.
Singapore-based cybersecurity company CYFIRMA said it observed Korean-speaking participants discussing reconnaissance and attack planning on I2P, an anonymity-focused network. The activity centers on two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 and collectively described as PHP2Shell.
The flaws could allow an attacker to send a specially crafted web request and remotely execute commands on a vulnerable server without first logging in. They received a severity score of 9.2 out of 10 under the Common Vulnerability Scoring System, placing them in the critical category. The PHP development team released emergency security updates on Oct. 21.
According to the researchers' assessment, the group was collecting publicly available proof-of-concept exploit code, using an artificial intelligence model to rank potential targets and testing the code in controlled environments before deployment. The reported target list gives priority to government agencies, banks and other financial institutions. It also includes manufacturing, logistics, shipping, aviation, online trading, construction and international commerce.
Beyond South Korea, the countries and regions discussed as potential targets reportedly include the United States, Japan, Australia, Taiwan, India, Singapore, the United Arab Emirates, Saudi Arabia and the European Union. The scale and diversity of the list underline the potential reach of a vulnerability affecting common server software.
CYFIRMA labeled the activity the June 2026 Minjun campaign and assessed that the actors may belong to or have links with the ecosystem surrounding Lazarus Group, a hacking organization widely associated with North Korea. However, the company assigned only moderate confidence to that attribution.
No direct overlap in malware or attack infrastructure has yet been publicly established. Korean-language communications, the focus on government and financial targets, and similarities to web-shell techniques previously attributed to Lazarus are circumstantial indicators rather than definitive proof. Security specialists therefore caution that the threat activity and the identity of the actor should be evaluated separately.
South Korea's science ministry and the Korea Internet & Security Agency raised the country's cyber crisis alert to caution on Oct. 22 and distributed response guidance to companies and critical infrastructure operators. Organizations running PHP-based services face an immediate need to install supported patched versions, restart affected services and inspect logs and systems for signs of compromise.