Cyfirma links PHP2Shell scans of 216 hosts to North Korea

Cyfirma has linked scanning of 216 vulnerable PHP hosts to a suspected North Korean campaign, likely tied to the Lazarus family. Operators coordinate in a closed I2P channel, scan from 21 compromised machines and use a local AI model to rank public exploits.

• 216 hosts remain unpatched or only partly mitigated
• Scanning runs from 21 nodes, about a third of targets checked
• Cyfirma gives the campaign an imminence score of 78 out of 100
• Fixes shipped October 21 for CVE-2026-109618 and CVE-2026-109619