[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPfEF7yY-E7elVicNHPnjK-Dzar7iGMMRnaB--3aDyK4":3},{"article":4,"iocs":51,"watch_terms":58,"solutions":59,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"8727b491-2e54-4cc9-852e-167237baf010","PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts","php2shell-suspected-north-korean-campaign-targets-216-vulnerable-php-hosts-18fe30","Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. The flaws affect all PHP versions that handle web requests. The vulnerable code dates […]","A suspected North Korean campaign, dubbed PHP2Shell, is targeting 216 vulnerable PHP hosts using AI to rank public exploits. The campaign leverages two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP, which were patched on October 21. Despite rapid patching efforts, a North Korea-linked group is actively scanning for and potentially exploiting unpatched systems.","North Korean campaign targets 216 PHP hosts with critical vulnerabilities","https:\u002F\u002Fsecurityaffairs.com\u002F201748\u002Fhacking\u002Fphp2shell-suspected-north-korean-campaign-targets-216-vulnerable-php-hosts.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fimage-59.png","2026-10-26T09:58:31+00:00","2026-10-26T11:00:05.022147+00:00",8,[17,20,23,26],{"name":18,"type":19},"Lazarus Group","threat_actor",{"name":21,"type":22},"PHP","product",{"name":24,"type":25},"AI","technology",{"name":27,"type":25},"I2P","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":28,"icon":30,"name":31,"slug":32},null,"Nation-state","nation-state",[34,36,41,46],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56],{"type":53,"value":54,"context":55},"cve","CVE-2026-109618","Critical vulnerability in PHP",{"type":53,"value":57,"context":55},"CVE-2026-109619",[21],{"controls":60,"vendors":147},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":91,"name":92,"problem":93,"products":94},"patch-management","Automated patch management","Known holes get closed in days, not months.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":50,"name":120,"problem":121,"products":122},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[148],{"slug":149,"name":150,"logo_path":151,"roles":152},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png",[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":166},"north-korean-actors-exploit-unpatched-php-vulnerabilities-across-hundreds-of-hosts","North Korean Actors Exploit Unpatched PHP Vulnerabilities Across Hundreds of Hosts","The PHP2Shell campaign highlights the dangerous window of exposure that exists between a patch release and its widespread deployment. Despite critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) being patched on October 21, 216 hosts remained unpatched and actively targeted by a suspected North Korean threat actor. The use of AI to rank and prioritize public exploits means adversaries can accelerate their attack cycles faster than many organizations can respond. This matters because nation-state actors are increasingly opportunistic, systematically scanning the internet for unpatched systems within hours or days of a public disclosure. Organizations without mature, rapid patch deployment processes become low-hanging fruit for sophisticated, well-resourced attackers.",[159,160,161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":167,"PCI DSS Requirement 6":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"OWASP A06:2021 Vulnerable and Outdated Components":170,"CIS Control 7: Continuous Vulnerability Management":171,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":172,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":173},"NIS2 requires essential and important entities to implement incident handling and vulnerability management measures, including rapid response to actively exploited vulnerabilities like those leveraged in PHP2Shell.","PCI DSS Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches promptly, which would have directly prevented exploitation of the unpatched PHP vulnerabilities targeted in this campaign.","SI-2 requires organizations to identify, report, and correct software flaws within defined timeframes — directly addressing the failure to patch the critical PHP vulnerabilities promptly after disclosure.","The campaign specifically targets PHP hosts running vulnerable component versions — exactly the risk OWASP A06 addresses by requiring organizations to track and remediate known vulnerabilities in their software components.","A structured vulnerability management program with defined patching timelines would have ensured the October 21 PHP patches were applied before North Korean actors began scanning for exposed hosts.","This control mandates timely identification and remediation of technical vulnerabilities in deployed software, which would have reduced the exposure window exploited by this campaign.","Limiting which internet-facing PHP services are exposed and enforcing least-privilege access would have reduced the attack surface available for the threat actor's automated scanning and exploitation efforts."]