PHP2Shell: Unit 42 pulls European-agency claim as scanning spreads

Two weeks into the PHP2Shell mass-exploitation story, the attribution is getting walked back. Palo Alto Networks Unit 42 has retracted its earlier assessment that a post-compromise intrusion at a European government agency involved the PHP2Shell flaws, and threat-intel firm CYFIRMA is tracking a separate, suspected North Korea-linked scanning campaign. The underlying bugs — CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 — remain unauthenticated RCE in default PHP configurations, and exploitation is ongoing. Reporting here follows The Hacker News and SecurityWeek.

What's affected

Both flaws allow unauthenticated remote code execution against PHP serving web requests, with mod_php setups at greatest risk. Patches shipped in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 (BleepingComputer has the release details); PHP 8.1 and older are end-of-life and get no fix, though some distributions ship backports. Bitsight counts nearly 37 million internet-facing systems running PHP or related software, concentrated in the US, Germany, France, the Netherlands, and Japan. Exploit details leaked before the planned disclosure, which is what turned this from a patch-cycle item into a race.

Exploitation status

• watchTowr reported exploitation in its honeypot network as of October 21; Cloudflare reported millions of attempts, some using modified payloads to evade WAF rules.
• The Hacker News and SecurityWeek report Mirai botnet operators have joined the exploitation attempts.
• Unit 42's retraction is the day's news on attribution. A spokesperson told The Hacker News: "We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs." The agency intrusion is now described only as "an attack against a European government agency executed in the context of a vulnerable PHP application" — initial access vector unconfirmed. Unit 42's earlier, now-withdrawn account had the attacker reaching Domain Admin attempts within two hours.
• CYFIRMA reports a suspected North Korea-linked campaign probing global PHP infrastructure from 21 compromised nodes, hitting 216 unpatched or partially mitigated hosts across the US, Japan, South Korea, and the EU among others. CYFIRMA assesses only moderate confidence linking a Korean-speaking operator to the Lazarus Group ecosystem — on C2 infrastructure overlap and historical PHP/WordPress targeting, not a direct tie. CYFIRMA's Kumar Ritesh: "The scanning is deliberately low-volume and paced."

Action checklist

1. Patch PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (or your distribution's backport). Per Bitsight, only updating PHP on the host closes the gap — WAF rules and plugin updates do not.
2. If you're on PHP 8.1 or older, you are unpatched. Upgrade to a supported branch or confirm your distro backported the fix.
3. Hunt for post-exploitation, not just the probe. Huntress points to suspicious child processes spawned by PHP workers (shells, downloaders). ReliaQuest describes a crash signature: a POST returning 500, PHP memory exhaustion and heap corruption, then an Apache worker crash.
4. Treat exposed PHP servers as targeted. CYFIRMA warns organizations in the prioritized sectors and geographies should assume they are in scope.

What other outlets missed

Most coverage still repeats Unit 42's original European-agency narrative. The operative fact as of October 25 is that Unit 42 pulled the PHP2Shell linkage — the breach may not be a PHP2Shell case at all. We verified the retraction against Unit 42's own statement to The Hacker News and flag it because the two live, confirmed threats here are the mass scanning and the leaked exploit details, not a single disputed intrusion. Attribution on the scanning side is hedged at moderate confidence; nobody has made the Lazarus call official.