Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure

    Tuesday, October 27, 2026 In: Threat Research Print

    Date: 10/27/2026

    Severity: Critical

    Summary

    A suspected North Korean (DPRK)-linked campaign is progressing from reconnaissance to targeted scanning of global PHP infrastructure, exploiting CVE-2026-109618 and CVE-2026-109619, critical unauthenticated remote code execution vulnerabilities in PHP core. Operators reportedly filtered 216 potential targets and are conducting low-and-slow vulnerability checks through 21 compromised nodes, with government and banking, financial services, and insurance (BFSI) sectors prioritized. The campaign's geographic focus includes the USA, Japan, Thailand, Indonesia, South Korea, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia, and the EU. Organizations should immediately patch affected PHP versions, restart PHP workers, and investigate for exploitation activity dating back to October 17, 2026. 

    Indicators of Compromise (IOC) List 

    Domains/URLs

    http://92.118.112.100/nfs

    IP Address

    146.70.114.180

    146.70.114.182

    147.175.149.67

    147.78.168.57

    109.56.219.150

    158.173.75.178

    185.203.18.54

    185.235.212.105

    103.77.210.80

    128.90.176.13

    138.199.34.201

    145.255.150.25

    149.102.232.44

    149.102.232.93

    158.173.242.133

    147.78.168.67

    102.207.250.188

    94.154.43.185

    75.119.143.189

    117.203.73.63

    146.190.107.103

    95.217.164.124

    124.122.142.142

    188.80.228.122

    134.209.181.133

    134.209.252.157

    119.63.72.54

    138.68.161.170

    95.216.5.90

    103.21.161.105

    115.96.27.126

    185.207.232.121

    78.47.85.99

    92.118.112.100

    103.216.220.92

    Hash

    b61a098fc62a2c2696e196dca78da71a

    c472dab4ff7c16782a8037f988d4daa6d4bdb343

    0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486

    43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a

    7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6

    User-Agents

    php2shell-scan/109618

    php2shell-verify/1.0 · php2shell-109618

    Mozilla/5.0 (php2shell-poc)

    Commands

    uname -a; id; echo JACKALPOC

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "http://92.118.112.100/nfs" or url like "http://92.118.112.100/nfs" or siteurl like "http://92.118.112.100/nfs"

    Detection Query 2 :

    dstipaddress IN ("103.21.161.105","124.122.142.142","188.80.228.122","185.207.232.121","147.78.168.67","158.173.75.178","128.90.176.13","115.96.27.126","185.235.212.105","138.199.34.201","78.47.85.99","119.63.72.54","109.56.219.150","149.102.232.93","103.216.220.92","134.209.252.157","103.77.210.80","146.70.114.182","146.190.107.103","95.217.164.124","134.209.181.133","95.216.5.90","145.255.150.25","185.203.18.54","138.68.161.170","94.154.43.185","117.203.73.63","92.118.112.100","75.119.143.189","146.70.114.180","102.207.250.188","147.175.149.67","158.173.242.133","149.102.232.44","147.78.168.57") or srcipaddress IN ("103.21.161.105","124.122.142.142","188.80.228.122","185.207.232.121","147.78.168.67","158.173.75.178","128.90.176.13","115.96.27.126","185.235.212.105","138.199.34.201","78.47.85.99","119.63.72.54","109.56.219.150","149.102.232.93","103.216.220.92","134.209.252.157","103.77.210.80","146.70.114.182","146.190.107.103","95.217.164.124","134.209.181.133","95.216.5.90","145.255.150.25","185.203.18.54","138.68.161.170","94.154.43.185","117.203.73.63","92.118.112.100","75.119.143.189","146.70.114.180","102.207.250.188","147.175.149.67","158.173.242.133","149.102.232.44","147.78.168.57")

    Detection Query 3 :

    md5hash IN ("b61a098fc62a2c2696e196dca78da71a")

    Detection Query 4 :

    sha1hash IN ("c472dab4ff7c16782a8037f988d4daa6d4bdb343")

    Detection Query 5 :

    sha256hash IN ("0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486","43898a0a53bbd25d31ad9f5018ed3182be98a66109b22c9cab545a9fc447992a","7bc41ed79a9ae909927a9e40701736460a8cb70fca16ce1510e58677aca764b6")

    Detection Query 6 :

    datasourcename = "Unix" AND commandline like "uname -a; id; echo JACKALPOC" 

    Reference:    

    Suspected DPRK PHP2Shell Campaign Targets Global PHP Infrastructure   


    Tags

    MalwareThreat ActorVulnerabilityNorth KoreanDPRKCVE-2026RCEPHPGovernment Services and FacilitiesFinancial ServicesUnited StatesJapanThailandIndonesiaSouth KoreaAustraliaTaiwanIndiaSingaporeUAESaudi ArabiaEurope

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.