PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts
North Korean campaign targets 216 PHP hosts with critical vulnerabilities
A suspected North Korean campaign, dubbed PHP2Shell, is targeting 216 vulnerable PHP hosts using AI to rank public exploits. The campaign leverages two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP, which were patched on October 21. Despite rapid patching efforts, a North Korea-linked group is actively scanning for and potentially exploiting unpatched systems.
AI summary of the linked source. Not reviewed by an editor. How this works
Run PHP?
Get an email when a new story names PHP, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe PHP2Shell campaign highlights the dangerous window of exposure that exists between a patch release and its widespread deployment. Despite critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) being patched on October 21, 216 hosts remained unpatched and actively targeted by a suspected North Korean threat actor. The use of AI to rank and prioritize public exploits means adversaries can accelerate their attack cycles faster than many organizations can respond. This matters because nation-state actors are increasingly opportunistic, systematically scanning the internet for unpatched systems within hours or days of a public disclosure. Organizations without mature, rapid patch deployment processes become low-hanging fruit for sophisticated, well-resourced attackers.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-109618
- cve — CVE-2026-109619