North Korean-linked Scan Campaign Exploits New PHP Vulnerabilities, Targets Over 200 Sites

Cybersecurity firm Cyfirma has identified a coordinated scanning operation, dubbed PHP2Shell, that appears to be tied to a suspected North Korean threat actor. The campaign has probed at least 216 web servers running vulnerable versions of PHP, seeking to exploit two critical flaws disclosed earlier this month.

On October 21, the PHP development team issued emergency patches for CVE-2026-109618 and CVE-2026-109619, both assigned a maximum severity score of 9.2 on the CVSS v3.1 scale. The vulnerabilities allow remote code execution and privilege escalation, making them attractive targets for nation‑state actors looking to compromise web‑facing infrastructure.

According to Cyfirma, the PHP2Shell scans are distinct because they employ an artificial‑intelligence driven ranking system that prioritizes publicly disclosed exploits. This approach enables the attackers to focus on the most easily weaponizable flaws, accelerating the exploitation pipeline.

The analysis indicates that the scanning activity is systematic, employing automated tools to enumerate PHP installations and test for the presence of the two newly patched bugs. While no successful compromises have been publicly confirmed, the sheer number of hosts examined underscores the high value placed on these vulnerabilities.

PHP powers a substantial portion of the internet, from small blogs to large e‑commerce platforms. The rapid release of emergency patches reflects the project's commitment to mitigating risk, but it also places pressure on site operators to apply updates promptly. Failure to do so can leave servers exposed to the same automated probing demonstrated by the PHP2Shell campaign.

Security experts advise administrators to verify that their PHP installations are updated to the latest version, review logs for any signs of suspicious scanning, and consider additional hardening measures such as web‑application firewalls. Monitoring for abnormal traffic patterns can help detect early attempts at exploitation.

Cyfirma’s findings add to a growing body of evidence that state‑affiliated groups are increasingly leveraging AI to streamline vulnerability selection. As public exploit databases expand, the temptation to automate the hunt for high‑severity bugs grows, prompting calls for faster patch cycles and broader information‑sharing among vendors and defenders.

The incident highlights the ongoing challenge of balancing rapid software development with robust security practices. While the immediate threat may be contained through patch deployment, the underlying tactics—AI‑assisted exploit ranking and mass scanning—are likely to persist, shaping the threat landscape for web technologies in the months ahead.