Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits.

On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. The flaws affect all PHP versions that handle web requests. The vulnerable code dates back to PHP 5.4, released in 2012, and resides in the PHP engine itself rather than in individual applications. Attackers can exploit the flaws to execute code remotely by sending specially crafted HTTP requests, without authentication.

Exploitation attempts increased rapidly after the vulnerabilities became public. Cloudflare researchers reported tens of thousands of attempts within the first 45 minutes, hundreds of thousands in just two hours, and millions by October 22.

Cyfirma reported that a group of North Korea-linked group has identified 216 hosts that may still be vulnerable to PHP2Shell. The operators communicate through a private I2P channel that Cyfirma has monitored since October 22. On October 24, they reported that 216 hosts appeared to be unpatched or only partly protected, earlier than Cyfirma expected.

They are checking the systems from 21 compromised machines. At the time Cyfirma captured the conversation, the operators had already checked about one-third of the targets.

“Two handles active since March 2026, coordinating in a closed I2P channel; staging infrastructure shared in-channel.” states the cybersecurity firm. “Target set and scan nodes. “On 24 October the operators reported 216 unpatched or partially mitigated hosts and named 21 scan nodes; the same addresses were seen performing web-shell tooling and upload-progress session-poisoning attempts.”

The scanning is slow on purpose. Volume stays low, the machines rotate, and any node that shows filtering or rate limiting gets pulled and never reused. That’s why a rate-based alert will probably stay quiet.

Who’s behind it? Cyfirma assesses with moderate confidence a link to the Lazarus family of North Korean groups, based on language, operating style and old habits with PHP web shells and hijacked web servers. It has no shared malware or infrastructure to point to yet, and it admits that a Korean-speaking criminal crew without state backing would fit the same facts. Its confidence in the campaign itself is high.

Government agencies and banks come first. Next in line are logistics, ports, airports and aviation, manufacturing, and online transaction and trading platforms. The countries named are the US, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia and the EU.

Cyfirma has not named any victims or seen the full list of targeted systems. The operators have not announced when they plan to launch attacks, and the researchers have not confirmed that this group has compromised systems on a large scale. Cyfirma gives the campaign an imminence score of 78 out of 100. The operators plan to check all 216 hosts, select the most promising targets, and decide which publicly available exploits to adapt.

The group does not appear to be developing new exploits. Instead, its members use a local AI model to rank public exploit repositories, then test the results manually in a lab. Cyfirma believes this approach could help attackers turn newly disclosed vulnerabilities into working attacks more quickly. However, researchers warn that some proof-of-concept exploits shared online are fake and may contain malware, so downloading and running them can be dangerous.

Technical details leaked on October 20, ahead of coordinated disclosure, and the PHP project shipped fixes on October 21. Apache mod_php with default settings and prefork is the confirmed worst case for 109618, with full unauthenticated code execution. For 109619, PHP-FPM is validated through the upload-progress path.

One correction matters for your temporary controls. Early coverage tied the session upload-progress field to 109618, but PHP’s advisories put it under 109619 only. Disabling upload progress does nothing for 109618, so the two bugs need different stopgaps.

Triggering the bug is easy, but reliable code execution isn’t. The attacker has to land a follow-up request on the same worker and shape heap data into the freed space, otherwise the worker crashes or answers normally. VulnCheck reports working code execution on x86-64 with ASLR enabled against PHP 8.4.10 to 8.4.26, while ARM64 only leaks memory so far.

Short of code execution, attackers have already shown worker crashes, arbitrary file reads through OPcache and a leak of about 67 KB of process memory. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1, 8.0 and 7.4 get only minimal backports, and vendors such as cPanel EasyApache, CloudLinux, TuxCare and Plesk carry their own builds, so confirm coverage with yours.

Anything from PHP 5.4 to 7.3 has no fix, so migrate or isolate it. Restart every worker after patching, because a reload that keeps old workers alive leaves the stale state in place. Isolate anything internet-facing that you can’t patch within hours, starting with Apache mod_php.

If you suspect a host is compromised, capture memory and logs before you patch, since a restart destroys the CVE-2026-109619 state. Then rebuild the host from a trusted image and rotate every secret the PHP worker could reach. Hunt back to October 17, the earliest known exploitation, and use long time windows.

The strongest single signal is a PHP or web server process spawning something it never normally spawns. Application logs will usually show nothing, because the bug fires before application code runs. Look for odd multipart POSTs to endpoints that never take uploads, bursts of worker crashes and memory errors, new PHP files in web roots, and new cron jobs, local users or SSH keys.

Cyfirma includes Sigma, Splunk and YARA content, though it says the YARA set hasn’t been tested on real application code yet. It also lists 21 scan-node addresses, 17 source addresses from October 23 and 15 staging addresses, all defanged. Some scan nodes are described as compromised and may belong to victims, so hunt for prior contact before assuming who owns them.

If you can’t patch yet, the advisory suggests limits such as a low post_max_size and disabling session upload progress for 109619. Cyfirma is clear that none of it replaces patching. The operators’ own selection rule is the most useful detail in the whole advisory, because they dropped every host that showed a fixed version or sat behind heavy filtering. That makes a current version string a cheap filter against you, and for once being boring pays off.

“Hosts still bannering older PHP are the ones the operators kept.” Cyfirma states.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, PHP2Shell)

Citizen Lab confirmed Pegasus on a Serbian rector’s iPhone 6 days before elections, raising the known civil society spyware target count to 16.

The Citizen Lab published a research note confirming that the iPhone of Vladan Đokić, Rector of the University of Belgrade, was infected with NSO Group’s Pegasus spyware sometime in 2026. The infection used a zero-click exploit, meaning Đokić did nothing to trigger it. No tap, no opened file, nothing.

“In collaboration with the SHARE Foundation, we found with high confidence that Professor Vladan Đokić, Rector of the University of Belgrade, and prominent supporter of the Serbian student movement, was hacked with NSO Group’s Pegasus spyware in 2026.” states Citizen Lab.

Đokić became a prominent figure in Serbia’s student-led pro-democracy movement after refusing to facilitate a government crackdown on protesters. Serbian authorities raided his offices on March 31, seizing computers and servers. The Citizen Lab found the infection with high confidence and describes the investigation as ongoing.

The timing raises questions. The discovery came just six days before Serbia’s snap parliamentary elections on October 25. Until September, Đokić had been publicly named as a possible candidate to lead the Student List. Since he spoke out against the crackdown, pro-government media have repeatedly attacked him.

Citizen Lab explained what a Pegasus infection means. Once installed, the spyware can give its operator the same access to a device as its owner. This includes private and encrypted messages, and the ability to turn on the microphone and camera without the owner’s knowledge.

“With the assistance of the SHARE Foundation, the Citizen Lab analyzed forensic artifacts collected from Vladan Đokić’s Apple iPhone at his request and with his consent.” reads the report. “We found with high confidence that it was infected with NSO Group’s Pegasus spyware in 2026. The infection leveraged a zero-click exploit.”

In a statement published by the university, Đokić called the spyware “another attempt of intimidation.” He called for an independent investigation, the public release of its findings, and criminal prosecution of those responsible.

“Additionally, we note that Rade Bajić, who, as a prosecutor, investigated official corruption in a failed project in Belgrade, received an Apple Threat Notification.” continues Citizen Labs.

The Citizen Lab also flagged Rade Bajić, a senior prosecutor who worked on the “Generalštab” case, a corruption investigation into the removal of heritage protections from a Belgrade site to clear the way for a luxury development backed by a company linked to Jared Kushner, President Trump’s son-in-law. Bajić says he was removed from the investigation in November 2025 without explanation, and spoke at a student protest in February denouncing political interference in the case.

He received an Apple Threat Notification on August 13 and a reminder on August 27. The Citizen Lab treats this as a high-confidence indicator that his device was likely targeted with mercenary spyware. Forensic analysis of his device is still ongoing and no confirmation of infection has been published yet.

These two cases bring the known total to at least 16 members of Serbian civil society targeted or infected with commercial spyware in 2026. In September, the SHARE Foundation, with support from Citizen Lab and Amnesty International, reported an earlier wave of attacks. The victims included a student protester confirmed to have been infected with Pegasus, opposition party members, and local officials. Those cases occurred around the period leading up to Serbia’s March local elections. The latest confirmed case was discovered just six days before the October parliamentary elections.

Serbia’s security service dismissed the September reports as purely trivial sensationalism and said it operates within Serbian law. Citizen Lab did not identify who was behind the attack on Đokić’s phone. Pegasus is sold only to governments and state agencies, which limits the number of possible operators.

If you received an Apple Threat Notification, treat your device as compromised until a technical expert confirms otherwise. In Serbia, contact the SHARE Foundation. Everywhere else, Access Now’s Digital Security Helpline supports journalists, human rights defenders, and activists. Enable Lockdown Mode on your iPhone immediately, keep iOS updated, and get your close contacts and colleagues screened as well.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Pegasus)

An AI-generated intelligence report falsely identified weapons on a Chinese ship, nearly triggering a US military operation during the Iran war.

According to CNN, four sources familiar with the episode say an intelligence report circulated through the military claiming a Chinese vessel in the Middle East was carrying components for a nuclear weapons program. The response was immediate. Armed boarding teams were preparing to move in, and military planes were already in the air.

“The intelligence report, circulated across the US military this spring in the midst of the war with Iran, immediately set off alarm bells: A Chinese ship in the Middle East was transporting components of a nuclear weapons program.” reads the report published by CNN. “The US military swung into action with plans to intercept the vessel, according to four sources familiar with the episode. According to two of the sources, armed members of the US military were preparing to board the ship. Military planes were in the air, one of those sources and another source familiar with the incident said.”

Then someone checked the source. The report was described by a source as “entirely false” and reportedly came close to triggering an armed operation, with the potential to escalate tensions between the US and China.

“The report, according to one of the sources, was “entirely false.” continues the report. “But it also “almost started a war,” the source said. Any US operation against a Chinese vessel could have risked spiraling into an armed conflict between the two nations.”

The incident began when an analyst at Special Operations Command Pacific asked a chatbot to analyze intelligence about the ship’s manifest. The system combined open-source information with classified signals intelligence and produced a wrong conclusion about the cargo. The analyst then used AI again to turn that conclusion into a formal intelligence report.

Two AI passes, zero verification in between. The case shows the real danger of AI hallucinations in military and intelligence work: a wrong answer can move quickly through the system when nobody stops to verify it.

“The internal tools are mostly just copies of the commercial stuff wearing lipstick,” a former senior US official familiar with the AI systems used by military and intelligence analysts told CNN.

Which matters, because the Pentagon has been pushing hard in the other direction. Defense Secretary Pete Hegseth’s January “Artificial Intelligence Acceleration Strategy” explicitly aims to put AI models directly into the hands of three million military and civilian personnel, across every classification level. The strategy talks about eliminating bureaucratic barriers and accelerating experimentation. Nobody in that strategy seems to have planned for what happens when the model is confidently wrong.

The way AI is being used across the military is still far from consistent. Different branches use different tools, follow different rules and apply different safety checks. There is also no common system for verifying whether the information produced by these tools is correct. According to one source, this was not an isolated case, and similar AI errors have already appeared elsewhere in the intelligence community.

The bigger problem may not be the technology itself, but the pressure to use it quickly. Younger analysts, who have grown up with AI tools, may be more likely to trust their answers without checking them carefully.

As one source put it: “AI allows you to get to a bad idea faster.”

That’s the whole risk, compressed into eight words. Speed was supposed to be the benefit. Instead it’s the thing removing the last checkpoint where a human might have paused and asked whether the machine actually got it right.

Targeting decisions are one of the most sensitive areas for military AI because they can determine who is attacked and who is not. The speed of AI can become a problem when there are not enough checks to verify its conclusions before action is taken.

One source noted that there is still no clear guidance on how a human operator should prevent civilian casualties or friendly-fire incidents when AI is heavily involved in selecting targets. The biggest risk may not be an AI system acting on its own, but a confident and incorrect answer reaching decision-makers before anyone has time to challenge it.

In military operations, speed matters, but so does having someone able to stop and ask a simple question: is this information actually correct?

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI Hallucinations)