Lazarus Group Targets 30 South Korean Servers via PHP Vulnerabilities

• •Lazarus Group targeted 30 South Korean servers using critical PHP vulnerabilities.
• •The attack exploited CVE-2026-109618 and CVE-2026-109619, both with a CVSS score of 9.2.
• •The campaign affected a total of 581 servers across 10 countries, with significant focus on government and financial sectors.

The North Korean-linked Lazarus Group has targeted 30 servers in South Korea, exploiting critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) to conduct cyberattacks on key sectors including government, finance, and telecommunications. The attacks were part of a broader campaign that affected 581 servers across 10 countries, with the hackers using compromised IPs to deploy malicious web shells and steal credentials. CYFIRMA, a global threat intelligence firm, reported that the attackers scouted targets in a closed online channel, specifically mentioning promising IP ranges in South Korea and other countries. The vulnerabilities exploited are critical, with a CVSS score of 9.2, and have been since their disclosure. While the attackers were able to identify targets, it remains unclear if any successful breaches occurred. Security experts emphasize that simply updating PHP applications will not suffice; core PHP security patches must be applied.