PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
Summary: Palo Alto Networks Unit 42 retracted its earlier assessment that post-compromise activity at a European government agency involved PHP2Shell exploitation, saying it could not confirm initial access was tied to CVE-2026-109618 or CVE-2026-109619, though it had reported attackers accessing password hashes and MFA secrets within two hours and building an NTLM-relay tunnel into Active Directory. CYFIRMA separately reported a suspected North Korea-linked campaign using PHP2Shell to scan 216 unpatched or partially mitigated hosts across 12 countries and regions from 21 compromised nodes, coordinated via a closed I2P channel and attributed with moderate confidence to a Korean-speaking operator in the Lazarus Group ecosystem.
Key Takeaway: The scanning is deliberately low-volume and paced, with nodes rotated and abandoned at the first sign of blocking, so threshold-based alerting is unlikely to catch it - and CYFIRMA says organizations in the prioritized sectors and geographies should assume they are in scope for deliberate targeting.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Mentions
- CVE-2026-109618CVE-2026-109619
- Related
- Threats Day: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Cyber Risks ·Siemens Building Automation and Energy Products Cyber Risks · Nov 12, 2026Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026