PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity

Palo Alto Networks Unit 42 has retracted its earlier assessment that post-compromise activity targeting a European government agency involved exploitation of the PHP2Shell flaws, saying it cannot confirm that initial access was associated with the specific CVEs. Separately, CYFIRMA said it had uncovered a suspected North Korea-linked campaign using PHP2Shell to probe global PHP infrastructure from 21 compromised nodes, targeting 216 unpatched or partially mitigated hosts across government, finance, logistics, aviation and other sectors, with exploitation assessed as the next step.