II Cyber Warfare & Critical Infrastructure·Analysis·Asia-Pacific
The PHP patch is out, but Asia's attack window remains open
CYFIRMA said on 24 October that a Korean-speaking group is using PHP2Shell to target governments and banks in 9 countries. The headline is Lazarus, but the constraint lies in unpatchable servers dating back to 2012.
Cyber & Critical Infrastructure Desk · 25 October 2026 · 7 min read · 9 sources
Why it matters
The noise: North Korea's Lazarus group is attacking the world through a PHP flaw, yet CYFIRMA gives that link only moderate confidence. The signal: Censys counted 34.4 million vulnerable PHP services on 23 October. Exploitation began on 17 October, 4 days before the patch. The flawed code dates back to 2012, while patches shipped only for the 8.2–8.5 branches. What will close the window is not the patch but how fast old versions are retired.
Implications
- The campaign CYFIRMA has named June 2026 Minjun puts government agencies and banks in 9 countries, including South Korea, Japan, Taiwan and Australia, at the top of its target list.
- South Korea raised its private-sector cyber crisis alert to 'Caution' on 22 October; in Japan, the National Tax Agency temporarily shut down a service.
- PHP flagged a second remote code execution risk on 23 October; the fix for CVE-2026-115560 has been left to the next routine release.
Noise
Lazarus is using PHP2Shell to attack governments and banks worldwide
Signal
The real risk is unpatchable old PHP versions and exploitation that began before the patch
The noise is attribution, the signal is the unpatchable server
The week's headline was the PHP2Shell campaign that Singapore-based CYFIRMA disclosed on 24 October and linked to North Korea's Lazarus group. Yet the firm gives that link only moderate confidence. It writes that it found no direct match with known Lazarus malware or infrastructure. The high-confidence part of the attribution says something else. A Korean-speaking group has built 15-piece infrastructure and is preparing to finalise its target list on 25 October. The list prioritises government agencies and banks in 9 countries, 6 of which are South Korea, Japan, Taiwan, Australia, India and Singapore.
The quiet variable is not who is attacking but how many servers cannot be patched. According to Sysdig, the flawed code goes back to PHP 5.4, released in 2012, while the 21 October patches shipped only for the supported 8.2–8.5 branches. Censys counted 34.4 million vulnerable PHP services as of 23 October. Of 123 servers targeted by one attacker tracked by Hunt.io, about 57 ran PHP, most of them on unsupported 5.x–7.x versions. There is no patch for those servers. The only options are to isolate them, shut them down or upgrade.
Why the window opened before 21 October
Amazon's honeypots logged the first exploitation attempt on 17 October, 4 days before the patch. The PHP team said details leaked around 20 October through an early warning given to some critical infrastructure providers, which is why it brought the schedule forward. CJ Moses, AWS's security chief, said differing payloads and infrastructure pointed to multiple actors. CYFIRMA therefore advises organisations to hunt for signs of intrusion dating back to 17 October. In other words, the public disclosure date cannot serve as the start date for defence.
Speed also worked against Asia. Cloudflare counted tens of thousands of attempts in the 45 minutes after disclosure, hundreds of thousands within 2 hours and millions by the morning of 22 October. Chief executive Matthew Prince told Nikkei on 23 October that the network was seeing roughly 1 million attack attempts a minute, and that new flaws on the same scale would follow. On 23 October PHP also flagged a second remote code execution risk, CVE-2026-115560, whose fix was left to the next routine release.
Three Asian capitals, three different reflexes
Tokyo chose to shut down. On the evening of 21 October, Prime Minister Takaichi urged site owners on X to check whether they used PHP and to take sites offline temporarily if they could not patch quickly. The post passed 30 million views within hours. According to Reuters, Nomura, MUFG, ANA and JR East suspended some services, and the National Tax Agency temporarily closed a service. Japan had recorded more cyber incidents in the first 9 months of 2026 than in the whole of 2025.
Seoul raised the alarm. On 22 October the Ministry of Science and ICT and KISA lifted the private-sector cyber crisis level from 'Attention' to 'Caution' and asked for unpatchable servers to be isolated. Korea is simultaneously dealing with bank breaches that have run since September; as of 14 October, 16 financial institutions were counted as victims. Beijing made no call to shut down. The Ministry of Industry and Information Technology asked organisations to audit their systems and change passwords, and Tencent Cloud advised customers to update.
The constraint is institutional, not technical
The real constraint here is not the patch code but the capacity of institutions to retire old versions. In Seoul that capacity is weak on the investigative side too. According to the Seoul Economic Daily, the new Seoul Major Crimes Investigation Agency returned the police file on AI-assisted bank attacks within 3 days on 23 October. The head of the agency's cybercrime unit has not been appointed. A council to settle disputes over jurisdiction does not take effect until February.
Attribution stuck at moderate confidence is a political constraint as well. CrowdStrike tied the Korean bank attacks of late September, with moderate confidence, to a Chinese-speaking, financially motivated actor. Aju Press writes that there is no evidence linking those incidents to the PHP2Shell campaign. While the two files stay separate, Seoul cannot formally accuse any capital, and defence remains limited to technical measures.
What would disprove this reading
The first development that would disprove this reading is reliable exploit code never materialising. Previdian, Wordfence and Dataminr had seen no successful code execution as of 22–23 October. None of the 123 targets tracked by Hunt.io was compromised. VulnCheck, however, has developed a technique that chains the two flaws and bypasses address space layout randomisation on x86-64 systems. If no official breach notice linked to PHP2Shell emerges in Asia within the next 2 weeks, the window is narrower than assumed. The risk would then remain a problem for individual organisations.
The second falsifier would be CYFIRMA reporting no new preparation after the target list due on 25 October, and Korea lowering its alert back to 'Attention'. Conversely, the discovery of a web shell dated 17 October at a single Asian bank would lift the H2 probability above 30. The debate would then shift from patch speed to the accountability of institutions that keep old versions running.
Probabilities
Scenarios
| Scenario | Probability | Trigger | Market impact |
|---|---|---|---|
| H1Scattered, contained breaches | 55% | The campaign starts and web shells turn up at a few unpatched organisations, but there is no systemic financial disruption. | Precautionary shutdowns last for weeks, breach notices arrive one by one and alert levels stay high. |
| H2Targeted financial breach | 30% | A large PHP2Shell data leak is confirmed at a bank or government agency in Korea, Japan or Taiwan. | Regulators impose mandatory audits and notification burdens, and the attribution debate moves to the diplomatic level. |
| H3The window closes early | 15% | Reliable exploit code fails to appear, patching and isolation spread quickly and Korea lowers its alert. | The campaign is postponed and the risk remains a problem for small organisations running old versions. |
Module A
Constraints Matrix
STRUCTURAL AVG 3.8 · TACTICAL AVG 2.7Structural constraints dominate: the outcome is set more by these limits than by the actors' preferences.
Hard structural constraintspersistent · beyond the actors' will
Unsupported PHP versions
5/5The flawed code goes back to PHP 5.4 from 2012, and patches shipped only for the 8.2–8.5 branches; most of the 57 PHP servers tracked by Hunt.io ran 5.x–7.x and will get no patch.
Exploitation before the patch
4/5Amazon logged the first attempt on 17 October and the patch shipped on 21 October; servers compromised in that 4-day gap stay at risk after patching.
Moderate-confidence attribution
3/5CYFIRMA gave the Lazarus link moderate confidence and found no shared malware or infrastructure; Seoul is waiting for evidence before any formal accusation.
Investigative gap in Korea
3/5The Seoul Major Crimes Investigation Agency returned the bank attack file on 23 October; the council to settle jurisdiction disputes is not in force until February.
Tactical frictiontemporary · eases over time
Cost of precautionary shutdowns days
3/5Japan's National Tax Agency temporarily closed a service, and Nomura, MUFG, ANA and JR East suspended some services; the longer the outage, the higher the service cost.
Attack volume days
3/5Cloudflare said on 23 October it was seeing roughly 1 million attack attempts a minute on its network; scanning noise masks targeted attempts.
Second flaw unpatched weeks
2/5The fix for CVE-2026-115560 has been left to the next routine release; the interim workaround is setting session.upload_progress.enabled=0.
Module B
Signal vs Noise
SIGNAL 67% · NOISE 33%
- NOISE
Lazarus is using PHP2Shell to attack governments and banks worldwide
On 24 October CYFIRMA gave the Lazarus link only moderate confidence; no direct match with known Lazarus malware or infrastructure was found.
Aju Press — Suspected North Korea-linked hackers target Korean banks, government
- SIGNAL
The real risk is unpatchable old PHP versions and exploitation that began before the patch
Censys counted 34.4 million vulnerable PHP services on 23 October; the flawed code goes back to PHP 5.4 from 2012, and patches shipped only for the 8.2–8.5 branches.
The Hacker News — PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
- SIGNAL
Exploitation began before public disclosure
Amazon logged the first attempt on 17 October, 4 days before the 21 October patches; details leaked around 20 October.
BleepingComputer — Amazon says PHP2Shell exploitation began 4 days before patches
- SIGNAL
The attacker is using AI to speed up target selection
According to CYFIRMA, the group ranks public exploit code with an AI model, has built 15-piece infrastructure and will finish its list on 25 October.
- NOISE
The patches are out, so the crisis is over
On 23 October PHP flagged a second remote code execution risk, CVE-2026-115560, and left its fix to the next routine release.
The Hacker News — PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
- SIGNAL
Attack volume is not falling, and new flaws are expected
Cloudflare's chief executive said on 23 October the network was seeing roughly 1 million attempts a minute and that new flaws on the same scale would follow.
Nikkei Asia — More PHP-scale dangers lurk on the internet, CloudFlare CEO says
Module C
Asset-Class and Positioning Implications
| Asset class | Exposure | Transmission channel | H1 | H2 | H3 | Expected | Conviction | Horizon | What to watch |
|---|---|---|---|---|---|---|---|---|---|
| Equities | Asian cyber security services sector | Spending on emergency patching, monitoring and incident response | + | ++ | 0 | +1.15 | ●●● | 0–3 months | Breach notices from organisations in Korea and Japan |
| Equities | Korean and Japanese banking sector | Breach costs, compensation and audit burden | 0 | −− | + | −0.45 | ●●● | 0–3 months | Statements from Korea's Financial Services Commission |
| Volatility | Asian equity volatility | A financial infrastructure breach feeding into the risk premium | 0 | + | − | +0.15 | ●●● | 0–3 months | The VIX and regional volatility indices |
| Credit | Credit of Asian hosting and web service firms | Compensation and business interruption costs | 0 | − | 0 | −0.30 | ●●● | 3–12 months | Compensation and insurance disclosures by hosting firms |
Second-order effects
And then what?
Starting point
PHP2Shell exploitation began on 17 October, 4 days before the patch; 34.4 million PHP services were vulnerable on 23 October and there is no patch for unsupported versions.
- 1
Target selectionwithin days
Groups that have completed their target lists move from mass scanning to quiet, selective attempts on unpatched government and bank servers; risk rises even as public scanning data falls.
Watch: CYFIRMA and KISA updates after 25 October; web shell findings dated after 17 October
- 2
Breach notificationwithin weeks
The first targeted breaches are confirmed at a financial or logistics firm in Korea, Japan or Taiwan; regulators open breach notification and compensation procedures, and institutions extend shutdowns.
Watch: The first official breach notice in Asia linked to PHP2Shell and statements from Korea's FSC
- 3
Regulation and insurancewithin months
Regulators make rules on unsupported software versions binding, and cyber insurers tighten premiums and coverage terms for firms running old versions; active cyber defence powers return to the agenda in Japan.
Watch: Draft rules from Japan's FSA and Korea's FSC on outdated software versions
What breaks the chain
If reliable exploit code does not emerge within 2 weeks and unsupported servers are isolated, the chain stops at the first step; no successful code execution had been seen as of 22–23 October.
Triggers
Thresholds to watch
| Indicator | Threshold | Today | What it means |
|---|---|---|---|
| VIX volatility index | > 20 | 16.91 | A VIX above 20 would show a PHP2Shell breach at an Asian bank or exchange infrastructure spilling over into global risk appetite. |
Sources
- Aju Press — Suspected North Korea-linked hackers target Korean banks, government
- Electronic Times (전자신문) — Attack plan exploiting PHP flaw detected; possible link to North Korean hacking group under scrutiny
- The Hacker News — PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
- The Hacker News — PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
- BleepingComputer — Amazon says PHP2Shell exploitation began 4 days before patches
- Taipei Times (Reuters) — Millions of hacking attempts amid rush to patch PHP
- Nikkei Asia — More PHP-scale dangers lurk on the internet, CloudFlare CEO says
- Tech-ish — Japan's PM, the NSA and the FBI tell websites to update PHP or go offline
- Seoul Economic Daily — Financial Hacking Case Returns to Police as New Crime Agency Declines
Sourcing and verification rules: methodology · Report an error: contact
Related reports
IICyber & Infrastructure·Analysis·Asia-Pacific
In Japan, the cyber bill lands on balance sheets, not policies
On 27 October Tokyo made a rare request to block an attacker's website. The quieter number sits elsewhere: GMO's 2031 bond spread widened 52 basis points in eight days, because Japanese policies exclude ransom and often business interruption.
Cyber & Critical Infrastructure Desk · 30 October 2026 · 6 min
IICyber & Infrastructure·Analysis·Asia-Pacific
Asia's cyber wave hits brokers' rented servers, not the banks
GMO offered a 1 million dollar bounty on 28 October, and the same day 3 more Korean financial firms reported breaches. The headline is the ransom. The constraint is that the rented server layer between client and market falls outside critical infrastructure in both countries.
Cyber & Critical Infrastructure Desk · 28 October 2026 · 6 min
VTech & AI·Analysis·Asia-Pacific
AI chips are concentrating Asia's growth in a single line item
Korea grew 1% on 27 October and chips carried half of it. The same day brought reports that TSMC would raise packaging prices by up to 20%. The headline reads as strength. The constraint is growth tied to one cycle and packaging lead times that have doubled.
Technology Geopolitics Desk · 27 October 2026 · 7 min