# Source: PHP 취약점 노린 북한 해킹 모의 정황…핵심 타깃은 한·미·일 - 머니투데이

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

머니투데이: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP 취약점 노린 북한 해킹 모의 정황…핵심 타깃은 한·미·일 - 머니투데이

**머니투데이** · [https://www.mt.co.kr/tech/2026/10/24/2026102414170377166](https://www.mt.co.kr/tech/2026/10/24/2026102414170377166) · published 2026-10-24T14:26:36+09:00 · added by `curator@php.newsroom` · slug `mt-tech-2026-10-24-2026102414170377166`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Money Today (Korean), 24 October: signs of North Korean hacking planning exploiting the PHP vulnerability, with South Korea, the US and Japan as core...

## What it says, as the collector read it

#### PHP 취약점 노린 북한 해킹 모의 정황…핵심 타깃은 한·미·일 - 머니투데이

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `kr/news/mt/tech-2026-10-24-2026102414170377166`, snapshot `20261024T133450Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T133450Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Money Today (Korean), 24 October: signs of North Korean hacking planning exploiting the PHP vulnerability, with South Korea, the US and Japan as core targets. It says the global cybersecurity firm Cyfirma reported in a security report the day before that Korean-speaking hackers were seen planning attacks exploiting the flaw, suspected to be North Korean, in an activity it named 'June 2026 Minjun'; no actual intrusion has been found. The same single Cyfirma report as the EBN and Korea Economic Daily items.

> 다만 실제 침해 사례가 발견되진 않았다.

_Curator's translation:_ "However, no actual intrusion case has been found."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP 취약점 노린 북한 해킹 모의 정황…핵심 타깃은 한·미·일 - 머니투데이". Selected mechanically, not read by a person.

#### Capture notes

Language `ko`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261024T133450Z · HTTP 200 · https://www.mt.co.kr/tech/2026/10/24/2026102414170377166- `headers.json` 78f7a8b030886216969762f32bc1d809c0a474a33892878583c433cdb45c737c 1,516 bytes
- `page.html` 41ff83151d4b3d797c3d6fde55f50ccbe4375c3bdba2aadb694844b52cb76e50 76,145 bytes
- `provenance.json` b68e30f647833828851f0a85a2e813a13417c62d914523908882dc9ade73993d 1,504 bytes
- `text.txt` c4b5b04752433be6012bd4ac2637ae2b30e7fc9b49dc10d66a21be5efc0e6ef9 6,796 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/sources/mt-tech-2026-10-24-2026102414170377166/index.html