PHP2Shell update: suspected North Korean hackers line up targets as shutdowns hit Japan's emergency alerts and Bangladesh's banks
Security firm CYFIRMA says a suspected North Korea-linked group is slowly and quietly probing 216 unpatched or partly protected PHP servers belonging to governments, banks, airports and online payment platforms in more than a dozen countries, using the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619). Separately, Palo Alto Networks' Unit 42 has withdrawn its claim that an attack on a European government agency used PHP2Shell, saying it cannot confirm how the attackers got in. The precautionary shutdowns are still causing disruption: more than 500 service suspensions have been counted in Japan, where SoftBank paused emergency alert emails and NTT Docomo paused some disaster-information messages, while Bangladesh Bank and several other Bangladeshi banks and government sites took their websites offline. There are still no confirmed successful PHP2Shell break-ins.
Why it matters: Quiet, targeted scanning by a state-linked group is more worrying than the noisy mass scanning seen so far, and the main targets are exactly the kinds of organisations that hold money and personal data. Website owners should update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and check logs for suspicious activity. If you're in Japan and rely on carrier alert emails, use another official alert app until your provider confirms the service is back.
