PHP2Shell Exploited by Lazarus Group, Magento Skimmers Active, UK Biobank Breach Timeline

Today’s briefing covers three evolving threats with material implications for UK small businesses. First, CVE-2026-1096018 and CVE-2026-1096019, collectively known as PHP2Shell, are now confirmed exploited in the wild by threat actors linked to North Korea’s Lazarus Group. Roughly three quarters of the web runs PHP, including WordPress, WooCommerce and Magento installations. Unauthenticated remote code execution is possible on unpatched systems, with web shell deployment providing persistent access. Second, a payment card skimming campaign tracked via deepveindrilling.com has compromised 953 Magento stores since July 2025, injecting malicious JavaScript into CMS blocks and using browser fingerprinting to evade automated scanners. Third, UK Biobank’s prolonged offline period following a data breach attempt illustrates the operational reality of incident response timelines, even for well-resourced organisations. The episode provides actionable steps for confirming PHP patch status, auditing Magento CMS blocks manually, and assessing detection capability for personal data breaches under UK GDPR requirements.

Chapters

• Intro Mauven introduces the twenty-sixth of October briefing, flagging that PHP2Shell vulnerabilities first covered on the twenty-first are now confirmed exploited in the wild by Lazarus Group, shifting the conversation from vulnerability management to incident response.
• PHP2Shell: Lazarus Group, Confirmed Exploitation, Your Website at Risk CVE-2026-1096018 and CVE-2026-1096019 allow unauthenticated remote code execution on unpatched PHP servers. Exploitation is confirmed in the wild, linked to Lazarus Group’s Minjun campaign active since June 2026. Roughly three quarters of the web runs PHP, including WordPress, WooCommerce and Magento. Attack chain involves web shell deployment for persistent access. PHP 8.1 reached end of life in December 2024; PHP 8.2 reaches end of life in December 2025. Mauven provides three immediate actions: confirm PHP version and patching status with hosting provider in writing, verify version independently if possible, and review server access logs from June 2026 for anomalies.
• CTA Mauven encourages listeners to follow the show and share the episode with anyone managing a website or postponing PHP updates.
• Magento Skimming: 953 Stores, Over a Year Running Sansec research reveals a skimming campaign tracked via deepveindrilling.com has compromised 953 online stores, predominantly Magento, since July 2025 by injecting malicious JavaScript loaders into CMS blocks. Campaign exploits CVE-2025-54236, CVE-2026-48356 and CVE-2026-75650. Skimmer uses browser fingerprinting to evade automated security scanners and persists via localStorage. Mauven advises manual review of CMS blocks for script tags and external domains, verification of patching status for associated CVEs, and assessment of whether current monitoring would detect CMS block injection.
• UK Biobank: What the Breach Timeline Tells You UK Biobank, holding data on approximately 500,000 people, has been offline for months following an incident in which data was offered for sale on Alibaba. The organisation is awaiting government clearance to resume operations. Mauven highlights that UK GDPR requires breach notification to the ICO within 72 hours of becoming aware, emphasising that detection capability determines when that clock starts. Smaller organisations often discover breaches through external signals rather than internal detection. Mauven recommends access logging on systems holding personal data, anomaly alerting, and regular review of output.
• Outro Mauven summarises: PHP2Shell is confirmed exploited by Lazarus Group, Magento stores need manual CMS block audits, and detection capability for personal data breaches remains a structural gap. The episode closes with a reminder that the gap between knowing a risk and closing it is the recurring problem across all three stories.

Links

• https://www.bleepingcomputer.com/news/security/php2shell-vulnerabilities-exploited-in-the-wild/
• https://www.cyfirma.com/research/threat-advisory-minjun-campaign-targeting-php-infrastructure/
• https://www.theregister.com/2026/10/26/php2shell_exploitation_confirmed/
• https://www.ncsc.gov.uk/guidance/vulnerability-management
• https://www.sansec.io/research/deepveindrilling-magento-skimming-campaign
• https://www.theregister.com/2026/10/26/uk_biobank_preparing_to_resume/
• https://ico.org.uk/for-organisations/report-a-breach/