Threat reportThreat IntelligenceTL-2026-4537
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Weaponized Following Japanese Real Estate Extortion Campaign by kkkkevin777
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Weaponized (TL-2026-4537), also tracked as PHP2Shell, is a high-severity tracked intrusion set scored CVSS 9.2, first published 2026-10-27. It has no confirmed attribution, affects PHP Group PHP, references 2 CVEs (CVE-2026-109618, CVE-2026-109619), maps to 13 MITRE ATT&CK techniques (T1005, T1021.004, T1053.003), and is covered by 9 detection rules and 15 indicators of compromise.
- CVSS
- 9.2/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-4537
- Threat ID
- TL-2026-4537
- Also known as
- PHP2Shell, kkkkevin777 extortion campaign
- Severity
- HIGH
- CVSS
- 9.2 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- real estate, business services, technology, web hosting
- Target regions
- japan, taiwan
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Weaponized
Malware and tooling: PHP, PHP2Shell reproducer package
How PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Weaponized works
SOCRadar STRU reports an extortion operator (handle kkkkevin777) who compromised a Japanese real estate services company and ~20 Japanese websites via web shells, credential reuse and ransom-page takeover, then staged a PHP2Shell reproducer package targeting two unauthenticated memory-corruption flaws in PHP. The staged files contain no saved output confirming successful exploitation of a live target; both CVEs were separately added to CISA KEV on 2026-10-26.
On 2026-10-27 SOCRadar STRU published an analysis of an exposed attacker staging server (96.126.130.81) that revealed a hands-on extortion operation run by an operator using the handle kkkkevin777. The operator compromised a Japanese real estate services company around 2026-10-08/09 (the initial entry vector is not documented on the server; web shell deployment was already underway in scripts dated 2026-10-09) and then moved to roughly 20 other Japanese websites, predominantly real estate agencies and property-buying services, through shared-hosting credential reuse: an SSH private key stored on the staging server was used across multiple hosting accounts, a single database password was reused across victim sites with identical member-table structure, FTP credentials were harvested, and internal database ports were probed from the hosting network.
Persistence relied on PHP web shells with random 32-character hexadecimal filenames in image/upload directories, a PHP beacon injected into database configuration files (calling file_get_contents against 96.126.130.81:9001), a self-propagating PHP hook across the web root, a cron job that rewrote .htaccess every minute (granting 'Require all granted') to override owner lockout attempts, and a cron job sweeping victim directories for backup files. Victim sites were defaced with a Japanese 'system maintenance' notice and an admin-panel ransom page with a countdown to 2026-10-11 04:00 JST; 'relock' scripts restored the pages after owners removed them. Pressure tactics included a bulk sendmail script (staged 2026-10-10) with progress tracking and a kill switch, a draft 5ch newsplus post accusing the initial victim of failing to report to Japan's Personal Information Protection Commission, and a 'final warning' email to victim staff. The server held 16,061 member records (plaintext passwords, income, savings, addresses, property search details), although the operator claimed 167,000 members.
On 2026-10-21 a PHP2Shell reproducer package was added to the staging server, together with loop/single-child scripts, helper and debugger scripts, Docker builds with a custom tools folder, and probe/pipeline scripts, plus compiled Hong Kong and Taiwan IP ranges. On 2026-10-22/23 a Taiwanese company's Windows server was compromised via a parallel PowerShell C2 operation (port 8443), with exfiltration of 5 SQL Server backups (~345 MB), 663 FoxPro files (~703 MB) and 730 business emails (2024-2026). SOCRadar states the PHP2Shell files contain no saved output showing successful exploitation of a live site and that no connection to the real estate intrusions is confirmed.
The underlying PHP flaws were announced 2026-10-21 (fixed in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12; CVSS v4.0 9.2 per Rapid7). CVE-2026-109618 is memory corruption on out-of-memory: PHP's longjmp-based bailout leaves request memory uninitialized, and request shutdown reads or branches on attacker-sprayed forged structures. CVE-2026-109619 is a use-after-free in which session.upload_progress caches raw zval pointers into session hash tables that are destroyed when the session is flushed and reinitialized. Per Akamai, exploitation requires session.upload_progress.enabled=On (the default) and file-upload acceptance, and needs build-specific memory offsets. Rapid7 reports public PoCs that work only under narrow lab conditions and notes both CVEs were added to CISA KEV on 2026-10-26 (due 2026-10-29). Attribution of the operator is investigative leads only (Simplified Chinese script comments, fluent Japanese victim messages, SSH key comment administrator@chenzicccc, HK/TW range scanning); whether the handle is an individual or collective is unconfirmed. Organizations whose email domains appear in the stolen member data were not breached; the exposure is via their customers' reused credentials.
MITRE ATT&CK techniques used in TL-2026-4537
Collection
T1005 Data from Local System; T1114 Email Collection
Lateral Movement
Persistence
T1053.003 Cron; T1505.003 Web Shell
Execution
Command and Control
Defense Evasion
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1490 Inhibit System Recovery; T1491.002 External Defacement
Credential Access
Resource Development
Affected products and versions in PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Weaponized
- PHP Group — PHP
Vulnerable versions: 8.2 before 8.2.35; 8.3 before 8.3.36; 8.4 before 8.4.27; 8.5 before 8.5.12; 5.4 onward per vendor analyses
Fixed in: 8.2.35; 8.3.36; 8.4.27; 8.5.12
Remediation for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Weaponized
Patches
- Upgrade PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later (limited backports exist for PHP 7.4, 8.0 and 8.1)
Immediate actions
- Search web roots for the string 96.126.130.81 and for .whk.php, *.orig20261010, htaccess.their20261010 and random 32-hex-character PHP files in upload/image directories
- Review crontabs for entries that rewrite .htaccess to 'Require all granted' every minute or sweep directories for backup files
- Check web server logs for multipart requests with unusually long filenames returning HTTP 500
- Audit authorized_keys files and SSH login history on shared hosting accounts
- Block traffic to and from 96.126.130.81 at network and hosting-provider level
- Compare database contents against recent backups for alterations before engaging with any ransom demand
Workarounds
- Set session.upload_progress.enabled=0
- Set memory_limit=-1 administratively for the OOM issue (per Rapid7)
- On PHP 8.5 set fatal_error_backtraces=0
- Enforce frontend request size and multipart limits
Longer-term hardening
- Rotate all SSH keys, database passwords and FTP credentials on affected accounts and eliminate credential reuse across client sites
- Force customer password resets, migrate to hashed password storage and notify affected users
- Keep offline backups outside hosting accounts so an attacker cannot delete them
CVEs associated with PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Weaponized
Weaknesses (CWE) in PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Weaponized
Timeline of PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Weaponized
- Operator compromises a Japanese real estate services company (activity window 2026-10-08/09); entry vector undocumented, web shell deployment already underway by 2026-10-09
- Lateral movement to ~20 Japanese sites via shared hosting continues (2026-10-09 to 10-11); database backup sweeps run and customer-pressure bulk sendmail script staged; owner homepage backed up as index.php.orig20261010
- Ransom-page countdown expires at 04:00 JST; draft 5ch newsplus forum post prepared accusing the victim of non-reporting to Japan's PPC
- PHP2Shell reproducer package, loop/single-child scripts and Hong Kong/Taiwan IP ranges added to attacker staging server 96.126.130.81
- PHP project announces security releases fixing CVE-2026-109618 and CVE-2026-109619 (8.2.35, 8.3.36, 8.4.27, 8.5.12)
- Taiwanese company's Windows server compromised (2026-10-22/23); 5 SQL Server backups, 663 FoxPro files and 730 business emails exfiltrated
- Akamai publishes PHP2Shell vulnerability mechanics; no public PoC referenced at that time
- CVE-2026-109618 and CVE-2026-109619 added to CISA KEV; federal remediation due 2026-10-29 (per Rapid7)
- SOCRadar STRU publishes analysis of the staging server and campaign; server activity window ends
Sources cited for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Weaponized
- PHP2Shell Weaponized After Japanese Real Estate Extortion (SOCRadar STRU)
- Understanding PHP2Shell: Everything You Need to Know (Akamai)
- CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated RCE in PHP (Rapid7)
- CVE-2026-109618 & CVE-2026-109619: Two Vulnerabilities Allow Unauthenticated RCE in PHP (OX Security)
- CVE-2026-109618 / CVE-2026-109619 PHP2Shell PHP OOM RCE (Corgea)
- PHP2Shell patch (TryHackMe)
- CISA Known Exploited Vulnerabilities Catalog
Detection coverage for TL-2026-4537
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4537 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.