[Financial News] Activity has been detected indicating an attempt to exploit a critical security vulnerability in a programming language widely used on websites around the world to attack government agencies and financial companies. A group suspected of possible ties to a North Korean hacking organization is believed to have discussed attack plans in Korean and prepared for them using artificial intelligence (AI). However, direct North Korean involvement has not been confirmed. According to the security industry on the 24th, Singaporean cybersecurity firm CYFIRMA found indications that members of a group using Korean were preparing cyberattacks exploiting a PHP security vulnerability on a closed network that ensures anonymity. PHP is a programming language widely used to run websites and servers. The ‘PHP2Shell’ vulnerability discovered this time is a flaw that allows commands to be executed on a server using nothing more than a crafted request, without a separate login or authentication process. It scored 9.2 out of 10 in a security risk assessment and was classified as critical. The group preparing the attacks was found to have prioritized government agencies and financial institutions such as banks as targets. Manufacturers, logistics and shipping companies, airport- and aviation-related businesses, online trading platforms, trading companies and construction firms were also included among the targets. By region, those mentioned included South Korea, the U.S., Japan, Australia, Taiwan, India, Singapore, the United Arab Emirates (UAE), Saudi Arabia and the European Union (EU). AI was also used in preparing the attacks. CYFIRMA said the group systematically prepared by collecting publicly available exploit code for vulnerabilities, using its own AI model to prioritize attacks, and testing whether the code worked in a controlled environment before launching actual attacks. CYFIRMA named the activity the ‘June 2026 Minjun’ campaign and raised the possibility that it was linked to the North Korea-backed hacking organization Lazarus Group. However, it rated the confidence of its analysis of a North Korea connection as ‘medium.’ Cautious voices have also warned that it is difficult to conclude that an actual North Korean organization was involved. The use of Korean in the attack plans and the targeting of government and financial institutions were cited as grounds for suspecting a North Korea connection, but no overlapping traces of malware or attack servers directly linked to Lazarus have been found. Meanwhile, South Korean security authorities have also taken action. The PHP development team released an emergency update fixing the vulnerability on the 21st. The Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) issued a related security alert at the ‘Caution’ level on the 22nd and urged companies to conduct security checks and take countermeasures. [email protected] Kim Kyung-min Reporter