Suspected North Korean Group Scans 216 PHP Servers for PHP2Shell Flaws

A suspected North Korea-linked group is quietly scanning about 216 PHP servers for the PHP2Shell vulnerability, and it is doing so slowly enough to avoid tripping threshold-based alerts. Mirai botnet operators are running their own exploit attempts against the same bug. As of the latest reporting, no successful compromise has been confirmed.

The PHP2Shell vulnerability consists of two flaws, tracked as CVE-2026-109618 and CVE-2026-109619. Both allow unauthenticated code execution through crafted HTTP requests, so an attacker needs no login, only a network path to a vulnerable web application. CYFIRMA rates both at 9.2 under CVSS v4.0. PHP released fixes on October 21, one day earlier than planned, after the CVE IDs leaked online.

Who is scanning the 216 PHP hosts

The most detailed account comes from threat intelligence firm CYFIRMA. Its advisory, first published October 23 and updated October 24, says a Korean-speaking group has filtered a target set of 216 hosts. The group reportedly runs low-and-slow PHP checks from 21 compromised nodes and rotates among them.

Kumar Ritesh, CYFIRMA's founder and CEO, put the approach in one line to The Hacker News: "The scanning is deliberately low-volume and paced." CYFIRMA says that pattern is designed to avoid threshold-based alerts, which typically flag sudden bursts of requests from a single source.

The reported targets include government agencies, banks, airports and online transaction platforms. The hosts are reportedly located in the United States, Japan, South Korea, India, Australia, the European Union and elsewhere. By the October 24 update, the operators had reportedly checked about one-third of the targets, according to Security Affairs.

The DPRK-linked scanning is a small, quiet thread inside a much louder wave. Cloudflare reported tens of thousands of exploitation attempts within 45 minutes of disclosure and hundreds of thousands within two hours. By October 22, the count had reached millions, as The Hacker News reported.

Which PHP versions fix the PHP2Shell flaws

PHP's October 21 release covers four supported branches. If your server runs a release below the patched version on its branch, it is exposed.

Any version below these numbers remains vulnerable. If you run a branch not listed here, check the PHP release notes on php.net instead of assuming you are safe.

Hosting providers face the widest exposure, since one unpatched shared server can host hundreds of sites. Developers who ship PHP inside containers or appliance images need to rebuild those images, because the PHP binary inside them carries the flaw.

Mirai operators join the attacks

Mirai botnet operators have joined the PHP2Shell attacks, according to SecurityWeek. The attempts follow a broader pattern in which attackers try to deploy Mirai malware through the flaws.

Sophos linked one attempt to Potassium, a Mirai-derived botnet variant that can download more malware and launch DDoS attacks. Sophos had first published a report claiming a successful exploitation, then corrected it. Its countermeasures blocked the attempt, so the Potassium payload was never delivered.

A security firm has also built an exploit that gets past ASLR, or address space layout randomization, a memory protection that makes exploitation harder. SecurityWeek reported the work. No successful PHP2Shell compromise has been confirmed, and whether the bypass raises success rates is still an open question.

What the North Korea attribution does and does not prove

Attribution is the weakest link in the story. CYFIRMA rates its confidence as high for DPRK-linked operators and moderate for a link to the Lazarus Group. The reporting says the conclusion rests on language, operating style and targeting, not on shared malware or shared infrastructure.

That distinction matters. Similar language and cadence can come from a contractor, a copycat or a group borrowing tools. Mirai-derived botnets are also widely shared, which makes them a poor signature for any single actor. Defenders should treat the North Korea label as a working hypothesis.

CYFIRMA's advisory lists hunting indicators, including the User-Agent string php2shell-scan/109618. Cyber Security News also reported the indicators. The reporting says they are not proof of infection, so a match in your logs is a reason to investigate, not a verdict.

Early claims that were walked back

The first days of coverage were messy. Palo Alto Networks withdrew its claim of an attack on a European agency, according to The Next Web. Sophos corrected its report of a successful exploitation. Security Affairs summarized the state of play as millions of attacks with no confirmed successful exploits yet, in its own reporting.

The underlying issues had surfaced earlier. Wiz, OpenAI and Calif reportedly found them in August, according to SecurityWeek.

The lesson for administrators is practical. Treat any vendor claim of compromise, or of safety, as provisional until the CVE records, PHP's release notes and independent responders agree.

How to check your PHP server this week

1. Confirm your version. Run php -v on the server and compare the result with the table above.
2. Upgrade to the patched release for your branch. If you use a shared host or managed platform, ask the provider to confirm in writing that the update is live.
3. Search web directories for files you do not recognize. Check upload folders and recently modified PHP files, since web shells are a common follow-on payload for this kind of bug.
4. Review web server logs for the User-Agent php2shell-scan/109618 and the other indicators listed in the CYFIRMA and Sophos advisories. Use them to hunt, not as proof of infection.
5. If you find evidence, isolate the server, preserve logs and rotate any credentials the PHP process could reach. Hosting providers should notify affected customers promptly.

What to watch next

PHP has warned of a third PHP2Shell flaw but will not rush out a fix, according to The Next Web. Its identity and timing are still unknown, so administrators should track PHP's release announcements rather than treat October 21 as the end of the work. The ASLR bypass and the rotating scanners both bear watching, because either could turn attempts into confirmed compromises. The first verified breach will tell defenders far more than any early vendor claim has so far.