It has been reported that forces linked to the Lazarus Group, a hacking organization behind ...

It has been reported that forces linked to the Lazarus Group, a hacking organization behind North Korea, are preparing for a large-scale cyberattack by exploiting the fatal security vulnerability of the programming language "PHP," which is widely used on websites around the world. It is also known that the Korean government and financial institutions were first selected as targets.

According to Yonhap News on the 24th, Singapore's cybersecurity company CYFIRMA detected a situation in which Korean-speaking members plotted cyberattacks using PHP vulnerabilities in a closed network called "I2P," which guarantees anonymity.

It is understood that they discussed preliminary reconnaissance and specific attack plans to attack web servers around the world using PHP vulnerability 'PHP2Shell' (CVE-2026-109618, CVE-2026-109619).

PHP2Shell is a flaw that allows an attacker to execute commands remotely from a server with only a manipulated web request without going through a separate login or authentication process.

The common vulnerability assessment system (CVSS) scored 9.2 out of 10 points, which corresponds to the 'fatal' rating.

Cyperma believes that the organization involved in the preparation for the attack may belong to or be linked to the North Korean Lazarus Group ecosystem. However, the reliability of the analysis of the North Korean connection was evaluated at the level of 'moderate'.

According to the attack plan identified by Cyperma, they selected government agencies and financial institutions, including banks, as their top targets.

Manufacturing, logistics, shipping, airports and aviation, online trading platforms, trading companies, and construction companies were also included in the attack.

Some point out that there is not enough evidence to directly connect the preparatory forces for this attack with the North Korean Lazarus Group.

A security expert told Yonhap News, "Cyperma's basis for linking North Korea is Korean-language attack instructions, government and financial institutions, and attack tactics similar to the web shell method used by Lazarus in the past."

"It is difficult to independently verify whether the North Korean attack organization is actually involved with the data," he added. "It is appropriate to observe and respond to the risks of the vulnerability itself with priority, but classify the North Korean organization's involvement as information that needs further verification."

Meanwhile, the Ministry of Science and ICT and the Korea Internet Promotion Agency (KISA) issued a "caution" alert regarding PHP vulnerabilities on the 22nd. It also guided companies on security countermeasures.