DPRK-linked group plans PHP2Shell attacks

What was reported

On 23 October 2026, CYFIRMA published a threat advisory describing a closed, Korean-language I2P channel where two handlers discussed PHP2Shell reconnaissance and attack planning. CYFIRMA says it monitored the channel on 22 October between roughly 11:00 and 11:31 JST. The discussion covered passive version collection, sorting targets by country and sector, staging infrastructure and testing public proof-of-concept code.

This is a report about preparation, not a confirmed attack. CYFIRMA named no victim hosts and set no launch date. It said the first filtered target list was due by 25 October 2026, which is a planning milestone, not evidence that exploitation occurred.

Attribution is explicitly conditional

CYFIRMA assesses with moderate confidence that the operator is linked to the North Korean Lazarus ecosystem. It cites Korean-language use, targeting patterns and historical web-shell tradecraft, but reports no definitive malware-family or infrastructure overlap. That is not enough to call the group Lazarus as a fact. The defensible description is “suspected DPRK-linked” or “moderate-confidence Lazarus-ecosystem link”.

The report also separates the planning channel from other activity. CYFIRMA says 17 IP addresses seen on 23 October conducting web-shell tooling and session-poisoning activity do not, on their own, connect those addresses to the suspected DPRK-nexus channel.

Targets and limits

CYFIRMA lists government agencies and banks/financial institutions as priority sectors, followed by manufacturing, logistics and ports, aviation, online trading platforms, trading companies and construction. It names the US, Japan, Thailand, Indonesia, Korea, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia and the EU as target regions.

Those are stated intentions in a monitored channel, not a confirmed victim list. The report says 15 infrastructure IPs were shared, no victim hosts were named and no launch date was set. It also says its assessment did not execute or independently test exploit code.

No confirmed compromise

CYFIRMA states that no confirmed mass successful exploitation by this actor had been observed. That is narrower than “no one has been compromised” and narrower than “the group is only scanning”. It is an evidence boundary for this actor and this report.

The broader PHP2Shell picture is unchanged: exploit attempts have been extensive, a working chain has been demonstrated in controlled conditions, and no confirmed successful real-world RCE has been established in the reporting reviewed here. Attempts, laboratory exploitation and confirmed production compromise remain separate categories.

What administrators should do

There is no new upstream PHP release in the 24 October check. The four PHP2Shell fixes remain 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Patch the runtime, restart every worker, and verify the process that actually serves requests. The verification guide has the sequence.

If patching cannot happen immediately, use the scoped interim controls and keep patching as the exit condition. The mitigation guide explains their limits. For the separate CVE-2026-115560 session-upload issue, keep session.upload_progress.enabled=0 if it applies; that advisory still has no named fixed release.

CISA KEV catalog version 2026.10.23 still lists neither PHP2Shell CVE when checked on 24 October. KEV absence is not evidence that exploitation never happened; it is a catalog state with a timestamp.