Korean-speaking Hackers Target PHP Vulnerabilities in Global Campaign

• •Attackers are exploiting critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619).
• •Targets include government and financial institutions globally, particularly in Asia and the US.
• •Cyfirma has high confidence in the attack preparations but moderate confidence in the link to Lazarus.

A cybersecurity report from Cyfirma reveals that attackers, possibly linked to North Korea's Lazarus group, are preparing to exploit critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities allow unauthenticated remote code execution, posing a significant threat to government agencies, banks, and various sectors worldwide. The attackers are using Korean to coordinate their efforts via an anonymous network. Cyfirma has observed global reconnaissance and attack planning, with confirmed exploitation attempts noted since October 17, 2026. The vulnerabilities are considered critical, with a CVSS score of 9.2. Organizations running outdated PHP versions are advised to patch immediately and monitor for suspicious activity. The campaign, named the June 2026 Minjun campaign, is actively staged, with a target list expected by October 25, 2026.