Korean-speaking operators coordinating via a closed I2P channel have moved from reconnaissance to active, low-and-slow scanning of a filtered 216-host target set of internet-facing PHP systems. The activity targets CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), two critical unauthenticated remote code execution flaws in the PHP runtime itself, each scored CVSS v4.0 9.2. Fixes for supported branches shipped on 21 October 2026. Earliest confirmed exploitation activity dates to 17 October. Organizations running PHP below the fixed versions should treat the exposure as immediate and prioritize patching, worker restarts, and hunting.
Vulnerability Overview
PHP2Shell refers to two related memory-safety defects in the PHP core that enable unauthenticated RCE independent of the application running on top of the runtime. Both flaws are triggered by crafted multipart/form-data requests processed before application code or authentication executes. Highest observed reliability occurs against Apache mod_php in the default prefork MPM.
- CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): Out-of-memory corruption via longjmp() bailout when memory_limit is exceeded during request startup. Cleanup treats partially initialized request-owned memory as valid, enabling use-after-free and subsequent control of execution flow.
- CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): Stale global state (use-after-free) after a fatal error or interrupted request. Session upload progress handling (PHP_SESSION_UPLOAD_PROGRESS) is a primary path; the next request handled by the same worker reuses freed memory containing attacker-controlled data.
Affected versions include PHP 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27, and 8.5.x before 8.5.12. Older branches (8.1 and earlier) receive no official upstream fix. Public proof-of-concept tooling is circulating; multiple vendors observed scanning and early exploitation attempts before and immediately after the 21 October patch release. Successful exploitation yields code execution in the context of the web server process, enabling web shell deployment, credential access, and further lateral movement.
Campaign Analysis and TTPs
CYFIRMA collection of the closed I2P channel identified two Korean-speaking handles active since March 2026. The operators rank public proof-of-concept code with a local AI model, perform lab validation, and maintain infrastructure separation between staging hosts and compromised scan nodes. Tradecraft emphasizes low-and-slow pacing, node rotation, and burn discipline against filtered or rate-limited targets to avoid noisy sweeps.
On 24 October 2026 the operators reported a 216-host target set of unpatched or partially mitigated systems ready for scanning. Approximately one-third of the set had already been checked. Scan nodes were observed performing PHP web shell tooling and upload-progress session poisoning. No launch date or mass compromise has been observed. Confidence in campaign activity is high; linkage to the Lazarus Group ecosystem (APT38, Hidden Cobra, ZINC, Diamond Sleet) remains moderate, based on language, sector prioritization, geographic targeting patterns, and historical web-shell tradecraft. Infrastructure and malware overlap has not yet been confirmed.
Primary objectives appear dual-use: financial (initial-access resale, cryptocurrency theft, ransomware) and espionage against government and financial institutions. The operators filtered out hosts advertising fixed versions or heavy filtering, leaving systems that still advertise older PHP versions.
Target Profile and Risk
The 216-host set spans prioritized sectors and geographies. Tier-1 targets are government entities and banking/financial services institutions. Tier-2 includes manufacturing, logistics, shipping, airports, and aviation. Tier-3 covers online transaction platforms, trading firms, and construction. Geographies explicitly discussed include the United States, Japan, Thailand, Indonesia, South Korea, Australia, Taiwan, India, Singapore, the United Arab Emirates, Saudi Arabia, and the European Union.
Any organization running internet-facing PHP below the fixed versions should assume it may be in scope or will be added as scanning continues. Shared hosting, control panels (cPanel, Plesk), appliances embedding PHP, and environments using Apache mod_php face elevated risk. Reloads without full worker restarts leave stale process state that preserves the vulnerability window.
Mitigations and Hunting Guidance
Immediate actions:
- Patch all supported PHP instances to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart every worker process. Reloads leave vulnerable state.
- For unpatchable hosts (especially Apache mod_php and EOL branches), isolate from the internet or apply the following temporary controls and restart workers:
- session.upload_progress.enabled = 0
- fatal_error_backtraces = 0 (PHP 8.5)
- memory_limit = -1 (administrative enforcement only; removes resource protection)
- Constrain post_max_size, multipart part counts, and max_input_nesting_level
- Set pm.max_requests = 1 where feasible to shorten worker lifetime
- Block or closely monitor the scan-node, Version 2 source, and staging addresses listed in the Indicators section at perimeter and host firewalls.
- Hunt logs back to 17 October 2026 for low-volume multipart/form-data anomalies, worker crashes, unexpected session file modifications, and the user-agents and canary strings listed below.
- Preserve evidence (memory dumps, session files, request captures) before patching or restarting; restarts destroy CVE-2026-109619 state.
MITRE ATT&CK Mapping
| Tactic | Technique | ID | Notes |
|---|---|---|---|
| Reconnaissance | Active Scanning: Vulnerability Scanning | T1595.002 | Low-and-slow PHP version and weakness checks |
| Reconnaissance | Gather Victim Network Information: IP Addresses | T1590.005 | Target-set filtering |
| Resource Development | Obtain Capabilities: Exploits | T1588.005 | AI-assisted PoC triage |
| Resource Development | Stage Capabilities: Upload Malware | T1608.001 | Staging hosts and second-stage ELF |
| Initial Access | Exploit Public-Facing Application | T1190 | Unauthenticated RCE via multipart requests |
| Execution | Command and Scripting Interpreter: Unix Shell | T1059.004 | Post-exploitation shell |
| Persistence | Server Software Component: Web Shell | T1505.003 | Observed tooling on scan nodes |
| Credential Access | Unsecured Credentials: Credentials In Files | T1552.001 | Expected follow-on activity |
| Collection | Data from Local System | T1005 | Session and configuration access |
| Command and Control | Ingress Tool Transfer | T1105 | Second-stage dropper observed |
| Impact | Data Encrypted for Impact | T1486 | Ransomware objective assessed |
Indicators of Compromise
All indicators are defanged. Treat scan-node addresses as high priority for blocking. Staging addresses should be monitored and hunted rather than blindly blocked where shared infrastructure risk exists.
Scan-Node IPv4 Addresses (Observed 24 October 2026)
142.93.155[.]162, 134.122.38[.]73, 5.255.114[.]109, 165.22.232[.]198, 159.223.59[.]200, 192.177.131[.]13, 94.154.42[.]149, 173.249.16[.]178, 170.64.224[.]137, 170.64.226[.]40, 45.148.10[.]80, 152.237.230[.]29, 146.70.194[.]93, 185.157.109[.]60, 143.246.213[.]138, 144.91.70[.]51, 217.60.196[.]124, 151.253.243[.]219, 23.106.131[.]214, 173.249.16[.]192, 45.148.10[.]201
Version 2 Source IPv4 Addresses (23 October 2026)
102.207.250[.]188, 94.154.43[.]185, 75.119.143[.]189, 117.203.73[.]63, 146.190.107[.]103, 95.217.164[.]124, 124.122.142[.]142, 188.80.228[.]122, 134.209.181[.]133, 134.209.252[.]157, 119.63.72[.]54, 138.68.161[.]170, 95.216.5[.]90, 103.21.161[.]105, 115.96.27[.]126, 185.207.232[.]121, 78.47.85[.]99
Staging IPv4 Addresses (Shared in Channel, 22 October 2026)
146.70.114[.]180, 146.70.114[.]182, 147.175.149[.]67, 147.78.168[.]57, 109.56.219[.]150, 158.173.75[.]178, 185.203.18[.]54, 185.235.212[.]105, 103.77.210[.]80, 128.90.176[.]13, 138.199.34[.]201, 145.255.150[.]25, 149.102.232[.]44, 149.102.232[.]93, 158.173.242[.]133
Additional Indicators
- Dropper staging: 92.118.112[.]100, hxxp://92.118.112[.]100/nfs
- Pre-disclosure attempt: 103.216.220[.]92
- User-Agents: php2shell-scan/109618, php2shell-verify/1.0, php2shell-109618, Mozilla/5.0 (php2shell-poc)
- Multipart boundaries: ----p2s, ----p2shell
- Command canary: uname -a; id; echo JACKALPOC
- Second-stage ELF SHA-256: 0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486
- Second-stage MD5: b61a098fc62a2c2696e196dca78da71a
- Captured request body SHA-256: 43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a, 7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6
Source: CYFIRMA Threat Advisory (Version 3, 24 October 2026) – Suspected Campaign Staging PHP2Shell Targeting Against Global PHP Infrastructure.