Cyberattack threat targets global government and financial sectors via PHP vulnerability

Security researchers have detected preparations for large-scale cyberattacks targeting government agencies and financial institutions worldwide by exploiting critical PHP vulnerabilities known as ‘PHP2Shell’ (CVE-2026-109618 and CVE-2026-109619). The vulnerabilities, which carry a CVSS score of 9.2 out of 10, allow attackers to execute remote commands on servers without authentication.

Singapore-based cybersecurity firm CYFIRMA identified these activities within the anonymous I2P network, noting that the organizers used the Korean language. The firm has named this activity the ‘June 2026 Minjun’ campaign and suggested a possible link to North Korea’s Lazarus Group, though it rated the confidence of this connection as ‘moderate’. While the use of Korean and certain tactics resemble previous Lazarus operations, direct evidence such as shared malware or infrastructure has not yet been confirmed.

Targeted sectors include manufacturing, logistics, aviation, online trading, and construction. Priority geographic targets include South Korea, the United States, Japan, Australia, Taiwan, India, Singapore, the UAE, Saudi Arabia, and the European Union.

In response, South Korea’s Ministry of Science and ICT issued a ‘caution’ cyber crisis alert. The PHP development team has released emergency security patches, and authorities urge all organizations using PHP to update to the latest versions immediately to prevent unauthorized server access and data theft.