# PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Weaponized Following Japanese Real Estate Extortion Campaign by kkkkevin777

> SOCRadar STRU reports an extortion operator (handle kkkkevin777) who compromised a Japanese real estate services company and ~20 Japanese websites via web shells, credential reuse and ransom-page takeover, then staged a PHP2Shell reproducer package targeting two unauthenticated memory-corruption flaws in PHP. The staged files contain no saved output confirming successful exploitation of a live target; both CVEs were separately added to CISA KEV on 2026-10-26.

- **Published:** 2026-10-27T12:44:46Z
- **Last reviewed:** 2026-10-27T12:44:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4537
- **ID:** TL-2026-4537
- **Severity:** HIGH (CVSS 9.2)
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-109618, CVE-2026-109619

## Description

On 2026-10-27 SOCRadar STRU published an analysis of an exposed attacker staging server (96.126.130.81) that revealed a hands-on extortion operation run by an operator using the handle kkkkevin777. The operator compromised a Japanese real estate services company around 2026-10-08/09 (the initial entry vector is not documented on the server; web shell deployment was already underway in scripts dated 2026-10-09) and then moved to roughly 20 other Japanese websites, predominantly real estate agencies and property-buying services, through shared-hosting credential reuse: an SSH private key stored on the staging server was used across multiple hosting accounts, a single database password was reused across victim sites with identical member-table structure, FTP credentials were harvested, and internal database ports were probed from the hosting network.

Persistence relied on PHP web shells with random 32-character hexadecimal filenames in image/upload directories, a PHP beacon injected into database configuration files (calling file_get_contents against 96.126.130.81:9001), a self-propagating PHP hook across the web root, a cron job that rewrote .htaccess every minute (granting 'Require all granted') to override owner lockout attempts, and a cron job sweeping victim directories for backup files. Victim sites were defaced with a Japanese 'system maintenance' notice and an admin-panel ransom page with a countdown to 2026-10-11 04:00 JST; 'relock' scripts restored the pages after owners removed them. Pressure tactics included a bulk sendmail script (staged 2026-10-10) with progress tracking and a kill switch, a draft 5ch newsplus post accusing the initial victim of failing to report to Japan's Personal Information Protection Commission, and a 'final warning' email to victim staff. The server held 16,061 member records (plaintext passwords, income, savings, addresses, property search details), although the operator claimed 167,000 members.

On 2026-10-21 a PHP2Shell reproducer package was added to the staging server, together with loop/single-child scripts, helper and debugger scripts, Docker builds with a custom tools folder, and probe/pipeline scripts, plus compiled Hong Kong and Taiwan IP ranges. On 2026-10-22/23 a Taiwanese company's Windows server was compromised via a parallel PowerShell C2 operation (port 8443), with exfiltration of 5 SQL Server backups (~345 MB), 663 FoxPro files (~703 MB) and 730 business emails (2024-2026). SOCRadar states the PHP2Shell files contain no saved output showing successful exploitation of a live site and that no connection to the real estate intrusions is confirmed.

The underlying PHP flaws were announced 2026-10-21 (fixed in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12; CVSS v4.0 9.2 per Rapid7). CVE-2026-109618 is memory corruption on out-of-memory: PHP's longjmp-based bailout leaves request memory uninitialized, and request shutdown reads or branches on attacker-sprayed forged structures. CVE-2026-109619 is a use-after-free in which session.upload_progress caches raw zval pointers into session hash tables that are destroyed when the session is flushed and reinitialized. Per Akamai, exploitation requires session.upload_progress.enabled=On (the default) and file-upload acceptance, and needs build-specific memory offsets. Rapid7 reports public PoCs that work only under narrow lab conditions and notes both CVEs were added to CISA KEV on 2026-10-26 (due 2026-10-29). Attribution of the operator is investigative leads only (Simplified Chinese script comments, fluent Japanese victim messages, SSH key comment administrator@chenzicccc, HK/TW range scanning); whether the handle is an individual or collective is unconfirmed. Organizations whose email domains appear in the stolen member data were not breached; the exposure is via their customers' reused credentials.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Web Shell
- T1053.003 Cron
- T1059.001 PowerShell
- T1552.004 Private Keys
- T1021.004 SSH
- T1078 Valid Accounts
- T1114 Email Collection
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1491.002 External Defacement
- T1490 Inhibit System Recovery
- T1587.004 Exploits

## Sources

- [PHP2Shell Weaponized After Japanese Real Estate Extortion (SOCRadar STRU)](https://socradar.io/blog/php2shell-weaponized-japanese-real-estate-extortion/)
- [Understanding PHP2Shell: Everything You Need to Know (Akamai)](https://www.akamai.com/blog/security-research/understanding-php2shell-everything-you-need-to-know)
- [CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated RCE in PHP (Rapid7)](https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/)
- [CVE-2026-109618 & CVE-2026-109619: Two Vulnerabilities Allow Unauthenticated RCE in PHP (OX Security)](https://www.ox.security/blog/cve-2026-109618-cve-2026-109619-two-vulnerabilities-allow-unauthenticated-rce-in-php/)
- [CVE-2026-109618 / CVE-2026-109619 PHP2Shell PHP OOM RCE (Corgea)](https://corgea.com/research/cve-2026-109618-cve-2026-109619-php2shell-php-oom-rce)
- [PHP2Shell patch (TryHackMe)](https://tryhackme.com/resources/blog/php2shell-patch)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4537