#PHP2Shell is about to go from opportunistic to targeted. #CYFIRMA has surfaced a #Korean-speaking threat actor, assessed with moderate confidence to be linked to the #Lazarus ecosystem, coordinating sector- and country-prioritised exploitation of the two critical #PHP runtime flaws known as PHP2Shell (#CVE2026109618 / #CVE2026109619, CVSS v4.0 9.2, unauthenticated #RCE). What makes this different from the scanning everyone is already seeing: ▪️ Deliberate targeting: government and financial institutions first, then logistics, ports, airports, and manufacturing ▪️ Priority geographies: US, Japan, Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia and the EU ▪️ Disciplined tradecraft: public PoCs ranked with a local AI model, lab-validated before use, no noisy scanning ▪️ 15 pieces of staging infrastructure already shared; first filtered target list due by 25 October The flaw sits in the PHP runtime itself, not in any CMS or framework, so updating WordPress, Drupal, Magento, or Laravel does not fix it. One multipart POST can reach code execution before any application code runs. What to do now: ✅ Patch to PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 and restart every worker (a reload is not enough) ✅ Isolate anything you cannot patch within hours; Apache mod_php first ✅ Hunt back to 17 October 2026 ✅ Deploy the IOCs, Sigma and YARA content in the report Full advisory (TLP: CLEAR) with 33 IOCs, detection rules, and interim controls. #CyberSecurity #ThreatIntelligence #DPRK #CYFIRMA #CYFIRMA #ExternalThreatLandscapeManagement #ETLM cyfirma.com/research/cyfirma…