PHP2Shell Attack Is Live: How to Check If Your Server Is a Target

What Changed: From Staging to Active Scanning

For most of October, PHP2Shell was a story about two critical unauthenticated remote code execution flaws in the PHP runtime itself - the kind of bug that we covered in depth when the fixes landed. The actor behind it was preparation: infrastructure, tooling, target research. That changed in the early hours of October 24.

CYFIRMA's Version 3 advisory reports that at roughly 01:47 (channel time), the operators of a closed I2P channel - two Korean-speaking handles active since March 2026 - announced their first target set was ready: 216 hosts that still appear unpatched or only partially mitigated. The list arrived a day earlier than the operators themselves had predicted. By about 02:10, roughly one third of those hosts had already been touched by a separate set of 21 compromised scan nodes. CYFIRMA assesses with high confidence that the operation is North Korean state-nexus, affiliated with the Lazarus Group ecosystem (Lazarus, APT38, Hidden Cobra, ZINC / Diamond Sleet).

"Treat every internet-facing PHP host below 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as exposed, and any host still advertising an older PHP version as a likely member of the operators' 216-host target set. Patch immediately, restart all workers, and hunt back to 17 October 2026, the earliest known exploitation." - CYFIRMA advisory, Version 3, October 24, 2026

Two boundaries matter for honesty here, and we keep them throughout this guide. First, what is confirmed: the channel and its tasking, the 216-host claim, the 21 scan nodes and their observed activity (PHP web shell tooling and session upload progress poisoning attempts). Second, what is assessed rather than proven: the Lazarus affiliation, the exact entry technique, and AI-assisted weaponisation of public proof-of-concept code. Mass compromise has not been confirmed, and no victim has been named.

Here is the timeline in one table:

How the 216-Host Target List Was Built

The most operationally useful detail in the advisory is the filtering logic, because it tells you exactly what makes a host interesting to this actor. The operators did not keep every PHP server they found. They kept the ones that advertise weakness - and they recorded sector and country tags for each, with scan results written back into the same spreadsheet under a separate column.

The priority geographies named in the advisory are twelve: the United States, Japan, Thailand, Indonesia, South Korea, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia, and the European Union. The sector list runs to eight across three tiers, with government and financial institutions first, alongside logistics, airports and aviation, manufacturing, and online transaction platforms. PHP powers roughly three quarters of all websites whose server-side language is known, according to W3Techs - which is why a campaign like this builds a list rather than picking a single industry.

The tradecraft is patient, and that patience is the reason ordinary monitoring will not catch it. CYFIRMA describes low-and-slow pacing with deliberate avoidance of noisy sweeps, node rotation with logging of which addresses respond with expected indicators, and burn discipline: any node that meets filtering or rate limiting is marked, pulled from the active set, and never reused. If your defence plan is "our WAF would have blocked the scan," ask yourself whether it would have flagged a handful of paced requests spread across days - because that is the shape this activity takes.

The 21 Scan Addresses (and the Other 32)

These are the scan-node IPv4 addresses named in the Version 3 update, published by CYFIRMA in defanged form (dots replaced with [.] so the list can be shared safely - restore the dots before using them in firewall rules or log searches). Two cautions from the advisory itself: some of these nodes are compromised machines that may belong to victim organisations, so block and hunt rather than assume ownership; and these 21 supplement 17 earlier source addresses plus 15 staging addresses that remain valid, all listed in the full CYFIRMA advisory.

Check Your Server in Five Steps

The Seven-Day Response Plan

CYFIRMA structures its recommended actions in three priority tiers. This is the plan in full, with the owners the advisory assigns to each item:

Why the Restart Matters as Much as the Patch

This is the detail most coverage gets wrong, and it cuts both ways. Installing the fixed PHP packages is only half the job: PHP-FPM and Apache keep existing worker processes alive across a service reload, and those old workers still run the vulnerable code with stale state. CYFIRMA's advisory is blunt about the consequence - the hosts the operators kept on the target list are the ones still bannering older PHP after the fixes existed. A full restart (systemctl restart php8.3-fpm apache2, adjusted to your setup) is what actually retires the vulnerable workers.

But on a host where you suspect compromise, the same restart destroys evidence. The state associated with CVE-2026-109619 does not survive it. So the correct order on a suspect machine is the reverse of your instincts: preserve first (logs, memory capture, disk image), then patch, then restart. On a clean machine, patch and restart immediately - do not wait for a maintenance window that the actor may not respect.

Apache mod_php on Prefork: The Configuration They Like Most

CYFIRMA assesses - and we keep this in the assessed column, not the confirmed one - that the entry route is crafted multipart/form-data requests, with the highest success rate against Apache mod_php running in its default prefork multi-processing module. If that is your stack, the advisory places you first in the isolation queue: patch today, and if you cannot, pull the service behind filtering until you can. Running PHP through php-fpm instead of mod_php is a widely recommended long-term hardening step for exactly this class of memory-resident attack surface, independent of this campaign.

Running PHP 8.1 or Older? There Is No Patch Coming

The October 21 release covers the supported branches only: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier have no official upstream fix for PHP2Shell and never will - those branches are end-of-life, the same way an operating system past its support date stops receiving security fixes. Your options are a version upgrade, isolation behind heavy filtering (which, notably, is one of the two things that got hosts dropped from the target list), or retiring the service. The PHP Foundation's release announcement and the official changelog list the affected versions in full.

Why This Story Sounds Familiar

A campaign that filters the internet for servers bannering weakness, then works a quiet list, is the server-side version of a pattern we keep seeing on the user side: attackers go where the door is already open. The Gemini incident showed three real companies compromised through credentials their owners had left in public, and most consumer-facing attacks still start with a fake warning or a spoofed message rather than a memory exploit - which is why we maintain guides on removing fake virus pop-ups, stopping email spoofing with SPF, DKIM, and DMARC, and reading email headers forensically. Defences layer: an unpatched runtime undoes everything the layer above it did right. Even fully patched systems still need their humans trained, the same way Windows Update failures like error 0x80073712 need fixing before the next Patch Tuesday - and the same month that shipped these PHP fixes also shipped KB5127648 with an exploited Windows zero-day and KB5124008 with two more. October 2026 has been a month where "I will patch next week" was the expensive answer on every platform.