PHP2Shell exploitation targets government entities amid global scanning

by@CogAbility

Summary

Threat actors have exploited PHP2Shell vulnerabilities to penetrate a government entity in Europe, accessing sensitive data, such as password hashes and multifactor authentication secrets, within hours of the initial attack. This incident is part of a larger trend involving Korean-speaking operators linked to the Lazarus Group, who are actively scanning global PHP infrastructure and targeting various sectors, including government and finance. Researchers have noted that the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are critical and have led to widespread exploitation attempts across internet-facing PHP systems, prompting the development of detection tools to assist organizations in identifying and mitigating these threats.

Analysis

CYFIRMA: CYFIRMA is a cybersecurity firm that specializes in uncovering and attributing threat campaigns through intelligence monitoring. It identified a suspected North Korea-affiliated operation using PHP2Shell to probe global PHP hosts, linking the activity to Lazarus Group operators via infrastructure, channels, and operational patterns. Kumar Ritesh: Kumar Ritesh serves as CEO and founder of CYFIRMA, a cybersecurity firm focused on threat intelligence. He provided details on the deliberately low-volume scanning tactics employed in a suspected North Korea-linked PHP2Shell campaign targeting infrastructure across multiple countries and sectors. Palo Alto Networks: Palo Alto Networks is a network security company with a dedicated Unit 42 threat intelligence team that tracks and analyzes cyber incidents. In this incident, Unit 42 reported on attackers using agentic AI for rapid post-exploitation after abusing PHP2Shell vulnerabilities against a European government entity, including reconnaissance and privilege escalation steps. Detection: Researchers have identified reproducible log sequences and released tools to help organizations detect and respond to PHP2Shell exploitation attempts. Threat Actor: The PHP2Shell scanning campaign shows moderate-confidence links to Korean-speaking operators affiliated with the Lazarus Group ecosystem, prioritizing government and financial targets. Vulnerability: Two critical PHP2Shell remote code execution flaws have triggered widespread scanning and exploitation attempts across internet-facing PHP systems.

Categories

techcryptoaimacro
View Original Tweet