Skip to content
NewsIncident

CYFIRMA says a suspected North Korea-linked group is using AI to triage PHP2Shell exploits

· by Pondero Newsdesk

The short version

CYFIRMA tied a disciplined 216-host PHP2Shell scan to a suspected North Korean operator using AI to rank exploits, while Palo Alto Networks retracted a separate claim tying an AI-agent attack to the same flaws.

CYFIRMA says a suspected North Korea-linked group is using AI to triage PHP2Shell exploits

The threat-intelligence firm CYFIRMA said a suspected North Korea-linked operator is using AI to rank public proof-of-concept exploits for the PHP2Shell flaws before lab-testing them, part of a disciplined scan of 216 target hosts that has not yet produced a confirmed breach. That is narrower and newer than the mass-exploitation wave Pondero reported on October 24: an operator picking targets rather than firing exploits at every exposed server.

What

CYFIRMA said in an advisory updated October 24, 2026, that the operator had reported a target set of 216 unpatched or partially mitigated PHP hosts and named 21 scan nodes conducting reconnaissance against PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619 per CYFIRMA's advisory. The group's operational style, in the firm's words, is "disciplined, access-focused... harvests public PoCs, ranks them with AI, lab-validates before use, avoids noisy scanning," and CYFIRMA assessed that this "AI-assisted triage of public PoCs compresses the gap from disclosure to reliable exploit" per CYFIRMA's advisory. The firm assessed with moderate confidence that the operator is linked to North Korea's Reconnaissance General Bureau and the Lazarus Group, citing I2P-channel chat using North Korean rather than South Korean vocabulary and spelling, Lazarus-linked command-and-control infrastructure, and a target list weighted toward government agencies and financial institutions per CYFIRMA's advisory. CYFIRMA said no victim organization has been identified and no mass compromise by this actor has been confirmed as of the advisory's October 24 update per CYFIRMA's advisory.

AI now speeds up both sides of PHP2Shell exploitation

CYFIRMA's advisory recommends blocking or monitoring 38 identified source addresses and hunting activity back to October 17, the earliest known exploitation date, rather than waiting for the operator to launch per CYFIRMA's advisory. That reflects the practical shift here: if AI triage is really compressing the time between a leaked proof-of-concept and a working exploit, defenders lose the lag they used to count on between disclosure and an attacker's first serious attempt. Operators running PHP below 8.5.12, 8.4.27, 8.3.36, or 8.2.35 should treat an older advertised PHP version as a plausible signal they are already on someone's list, not just a patching backlog item.

The same reporting cycle produced a second AI-related claim that did not hold up. Palo Alto Networks' Unit 42 had said attackers breached a European government agency and formatted stolen credential batches with delimiters such as ==SHELLUSER== and ==PASSWD== "to produce machine-parseable output for an AI model to read," then built an NTLM-relay tunnel into Active Directory within two hours of initial access, as Unit 42 told The Hacker News. Unit 42 retracted that update on October 25: "We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23," the company said in its own threat brief, clarifying only that the breached system ran a vulnerable PHP application, not necessarily one hit by these two CVEs per Unit 42's threat brief.

What to watch next

Watch whether Unit 42 or another vendor names the actual entry point behind the European agency breach, since the AI-formatted command batches are real attacker tradecraft even if PHP2Shell was not the way in. Watch CYFIRMA's advisory for a version update if the suspected North Korean operator moves from scanning its 216-host list to confirmed exploitation, and whether CISA adds the two CVEs to its known-exploited-vulnerabilities catalog.

Sources