OTX Threat: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure

A Korean-speaking threat actor, tracked as the June 2026 Minjun campaign and linked with moderate confidence to North Korea's Lazarus Group, is actively planning targeted exploitation of two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that enable unauthenticated remote code execution. The campaign prioritizes government agencies, financial institutions, manufacturing, logist CVEs: CVE-2026-109618, CVE-2026-109619 Sectors: Government, Finance, Manufacturing