PHP2Shell: suspected North Korean campaign and OT products hit

📌 Later developments: PHP2Shell on PAN-OS: fixes for five branches and Panorama (October 29, 2026) · PHP2Shell and Fragnesia: root on PAN-OS firewalls in 15 minutes (October 28, 2026)

On 26 October 2026 CISA added the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 to its KEV catalog, after the first shells were obtained on honeypots running PHP 8.4.26 with Apache mod_php (SecurityWeek, BleepingComputer). Our articles of 20 and 23 October cover the announcement, the fixed versions and the third RCE, CVE-2026-115560. What follows is new: a targeted campaign cautiously attributed to North Korea, the industrial products affected, the differences between the two CVEs and what to look for in your logs.

Two CVEs, two mechanisms

The NVD descriptions, now complete, make clear that these are different flaws:

• CVE-2026-109618: PHP uses longjmp() to bail out when memory runs out (OOM); some contexts leave request memory uninitialised, and the subsequent cleanup reads it. Triggering the OOM leads to code execution.
• CVE-2026-109619: global state pointing into request memory is not reset, so subsequent requests read memory that has already been freed.

PHP rates both at CVSS 4.0 9.2; NVD, using CVSS 3.1, gives 9.8 to CVE-2026-109618 and 8.1 to CVE-2026-109619 (high complexity). According to the NVD CPEs, CVE-2026-109619 affects PHP from 5.4.0 and CVE-2026-109618 from 7.3.0. Fixed versions: 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

According to Security Affairs, citing Cyfirma, the confirmed worst case for CVE-2026-109618 is Apache mod_php with prefork and default settings; for CVE-2026-109619, PHP-FPM via the session upload progress path has been validated. So session.upload_progress.enabled=0 only protects against CVE-2026-109619.

Triggering the flaw is easy; reliable code execution is not: the next request has to land on the same worker with memory already shaped. According to Security Affairs, VulnCheck achieves code execution on x86-64 with ASLR enabled against PHP 8.4.10 to 8.4.26, while on ARM64 it only gets memory leaks; assessments from a few days earlier said the opposite. The Register reports that a pentester won a public challenge by achieving RCE in about three hours with at most 20 requests, but with an exploit built for that specific target.

The campaign reported by Cyfirma

Only Security Affairs reports it, citing Cyfirma’s report:

• two operators active since March 2026 coordinate in a closed I2P channel, monitored since 22 October;
• on 24 October they listed 216 hosts that were unpatched or only partly protected, checked from 21 scan nodes (compromised machines), which were also seen using web shell tooling and attempting session poisoning via upload progress;
• scanning is deliberately slow, with rotating nodes dropped as soon as they hit filtering: volume-based alerts stay silent;
• the operators do not write new exploits: a local AI model ranks public ones, which they then test in a lab;
• they discarded hosts that showed a fixed version.

Cyfirma attributes the campaign with moderate confidence to the Lazarus family, based on language, operating style and use of PHP web shells, but with no shared malware or infrastructure, and acknowledges that a Korean-speaking criminal group would fit the same facts. Targets: government agencies and banks first, then logistics, ports, airports, manufacturing and transaction platforms; the European Union is among the regions named. No victims are known.

The report includes Sigma, Splunk and YARA rules (the YARA set not yet tested on real code) and the node addresses; some belong to possible victims, so contact with them does not identify the attacker.

MITRE ATT&CK techniques: T1595 (Active Scanning), T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell).

Industrial and network products affected

According to SecurityWeek:

• Schneider Electric: EcoStruxure Security Expert (fixed in 1.48.4.0), ProLeiT LINEoptimize, EcoStruxure Control Engineering (mitigations only for now);
• Siemens: RUGGEDCOM APE1808 running PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 (NVD also lists PAN-OS and the APE1808);
• ABB: MES with DokuWiki; B&R: APROL up to R 4.4-65;
• Johnson Controls: Illustra and Visonic PowerManage, fixed;
• Belden: NetModule NRSW with no patch (disable the web interface) and macmon 6.x and 7.x;
• HMS Networks (Netbiter) and Wibu-Systems (CodeMeter License Central): updates available.

Rockwell Automation and Moxa have no confirmed affected products; Hitachi Energy is investigating.

Impact for European and Italian companies

The EU is among the regions named, and logistics, transport, manufacturing and banking are NIS2 sectors. The tricky part is PHP inside third-party appliances and software: MES, access control, video surveillance, industrial routers. It does not show up in package inventories and is only updated through the vendor’s firmware. For NIS2 entities this is supplier management: ask each vendor and document their answer. In healthcare the same applies to hospital access control and video surveillance. A significant incident must be assessed for notification to the national CSIRT (in Italy, CSIRT Italia).

What to do now

1. Update and restart every worker: a reload that keeps old workers alive leaves the faulty state in place. 8.1, 8.0 and 7.4 only get minimal backports; cPanel, CloudLinux, TuxCare and Plesk ship their own builds. From 5.4 to 7.3: migrate or isolate.
2. Don’t rely on a single mitigation: disabling upload progress only covers CVE-2026-109619. If you can’t update within hours, isolate exposed systems, starting with mod_php.
3. Check your appliances, OT and network, against the vendor advisories.
4. If you suspect a compromise, capture memory and logs before updating (a restart wipes the CVE-2026-109619 state), rebuild from a trusted image, rotate the secrets the worker could reach and hunt back to 17 October.
5. What to look for: PHP or web server processes spawning unusual programs, multipart POSTs to pages that never take uploads, worker crashes and memory errors, new PHP files in web folders, new cron jobs, users or SSH keys. Application logs usually show nothing: the flaw fires before application code runs.
6. Don’t run PoCs found online: some contain malware.

How ARXDOME helps

ARX Shield shows open vulnerabilities per machine, highlighting those already exploited. ARX Sentry lists software and processes on servers with the agent, flags suspicious executions and checks file integrity in chosen folders, such as web roots. ARX Expose shows your public services and recognised products; ARX Radar also recognises slow scans and sources hitting several companies at once.

Last updated: 27 October 2026