Cyfirma

25/10/2026

PHP2Shell update: the DPRK-nexus campaign has moved from planning to active scanning.

CYFIRMA has issued Version 3 of its Early Warning advisory on PHP2Shell (CVE-2026-109618 / CVE-2026-109619, CVSS v4.0 9.2 — unauthenticated RCE in the PHP runtime itself).

What’s new since our 22–23 October reporting:
🔴 The operators report a filtered target set of 216 internet-facing hosts that still advertise unpatched PHP — across the US, Japan, South Korea, Thailand, Indonesia, Taiwan, Australia, India, Singapore, UAE, Saudi Arabia and the EU, with government, financial services, logistics, aviation, manufacturing and online transaction platforms prioritised.
🔴 Active weakness checks are being run from a separate set of 21 compromised nodes, deliberately low-volume and paced to stay under rate-based alerting. Roughly a third of the target set had already been touched at the time of collection.
🔴 CYFIRMA observed the same 21 addresses performing web-shell tooling and upload-progress session-poisoning attempts in the hours before this update. They are now published as blocking indicators alongside the 17 source IPs from Version 2.

What to do now:
✅ Patch to PHP 8.5.12+ / 8.4.27+ / 8.3.36+ / 8.2.35+ and restart every worker — a reload leaves the stale state in place.
✅ Hosts still bannering an older PHP version are exactly what the operators kept on their list. Isolate what you can’t patch within hours, Apache mod_php first.
✅ Hunt back to 17 October across extended time windows — this scanning is designed not to trip volume alerts.

No launch date has been stated. The next adversary milestone is their shortlist of highest-confidence hosts. The channel remains under continuous monitoring and the advisory will be re-issued on any launch statement or confirmed exploitation.

Read here: https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/?

Early Warning – PHP2Shell (v3): Suspected DPRK Campaign Staging PHP2Shell Exploitation Against Global PHP Infrastructure Korean-speaking operators have filtered a...

22/10/2026

𝐓𝐡𝐢𝐬 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐀𝐰𝐚𝐫𝐞𝐧𝐞𝐬𝐬 𝐌𝐨𝐧𝐭𝐡, 𝐡𝐞𝐫𝐞’𝐬 𝐚 𝐪𝐮𝐞𝐬𝐭𝐢𝐨𝐧 𝐰𝐨𝐫𝐭𝐡 𝐚𝐬𝐤𝐢𝐧𝐠 𝐲𝐨𝐮𝐫 𝐭𝐞𝐚𝐦: 𝐰𝐡𝐚𝐭 𝐜𝐚𝐧 𝐚𝐭𝐭𝐚𝐜𝐤𝐞𝐫𝐬 𝐬𝐞𝐞 𝐚𝐛𝐨𝐮𝐭 𝐲𝐨𝐮𝐫 𝐨𝐫𝐠𝐚𝐧𝐢𝐳𝐚𝐭𝐢𝐨𝐧 𝐭𝐡𝐚𝐭 𝐲𝐨𝐮 𝐜𝐚𝐧’𝐭?

Awareness is more than posters and training sessions. It means knowing what attackers could find about your organization, how they might use it and what needs your attention first.

These are the conversations we have been having with customers, security teams, partners and MSSPs at events and industry gatherings across the globe. Visibility alone isn’t the answer. What helps is making sense of what’s exposed, knowing which risks apply to your organization and which come first, and acting on them before attackers do.

Helping organizations see their risks clearly, prioritize what matters and act earlier is why we do this work, throughout the year.

Thank you to everyone who has joined these conversations and shared their experiences.

If you’d like to see your outside-in view and know what to prioritize and act on first, get in touch or request a free external exposure snapshot from our team.

04/09/2026

🏆 𝐂𝐘𝐅𝐈𝐑𝐌𝐀 𝐍𝐀𝐌𝐄𝐃 𝐓𝐄𝐂𝐇 𝐈𝐍𝐍𝐎𝐕𝐀𝐓𝐎𝐑 𝐎𝐅 𝐓𝐇𝐄 𝐘𝐄𝐀𝐑 𝟐𝟎𝟐𝟔! 🏆

We’re thrilled to announce that CYFIRMA has been named 𝑻𝒆𝒄𝒉 𝑰𝒏𝒏𝒐𝒗𝒂𝒕𝒐𝒓 𝒐𝒇 𝒕𝒉𝒆 𝒀𝒆𝒂𝒓 at the 𝗘𝗻𝘁𝗿𝗲𝗽𝗿𝗲𝗻𝗲𝘂𝗿 𝗕𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗔𝘄𝗮𝗿𝗱𝘀 𝟮𝟬𝟮𝟲! 🚀

This recognition is more than an award—it’s a testament to our relentless pursuit of innovation, intelligence, and a more proactive approach to cybersecurity.

In a world where cyber threats evolve faster than ever, organizations can no longer afford to simply react. At CYFIRMA, we’re pioneering preemptive cybersecurity—helping organizations anticipate threats, understand their adversaries, and act before attacks become incidents.

💡 Innovation is not just about building new technology. It’s about solving the problems that matter most.

This achievement belongs to the entire CYFIRMA family—our innovators, researchers, cybersecurity experts, partners, and customers who continue to challenge what’s possible.

A huge thank you to the Entrepreneur Business Awards for recognizing our journey and vision.

The threats are evolving. So are we.

And this is only the beginning. 🔥

30/08/2026

🔐 𝑪𝒚𝒃𝒆𝒓𝒔𝒆𝒄𝒖𝒓𝒊𝒕𝒚 𝒊𝒔 𝒆𝒗𝒐𝒍𝒗𝒊𝒏𝒈—𝒇𝒓𝒐𝒎 𝒅𝒆𝒕𝒆𝒄𝒕𝒊𝒏𝒈 𝒂𝒕𝒕𝒂𝒄𝒌𝒆𝒓𝒔 𝒕𝒐 𝒅𝒆𝒄𝒆𝒊𝒗𝒊𝒏𝒈 𝒕𝒉𝒆𝒎.

Traditional honeypots were just the beginning.

Today, deception environments are becoming a more strategic approach to cybersecurity—creating realistic, controlled environments designed to expose attacker behavior, understand their tactics, and disrupt threats before they reach critical assets.

In his latest Forbes Technology Council article, Kumar Ritesh, Founder & CEO of CYFIRMA, explores how deception technology is changing the way organizations think about cyber defense.

The future of cybersecurity isn’t just about building stronger walls.

It’s about making attackers believe they’ve found the way in—while you’re watching every move.

📖 Read the full article below ⬇️ https://www.forbes.com/councils/forbestechcouncil/2026/08/27/how-cybersecurity-is-evolving-from-honeypots-to-deception-environments/

Where a honeypot is a prop, a deception environment is a stage.

13/08/2026

𝑷𝒓𝒆𝒅𝒊𝒄𝒕𝒊𝒏𝒈 𝑪𝒚𝒃𝒆𝒓𝒂𝒕𝒕𝒂𝒄𝒌𝒔 𝑩𝒆𝒇𝒐𝒓𝒆 𝑻𝒉𝒆𝒚 𝑯𝒂𝒑𝒑𝒆𝒏

𝐓𝐡𝐞 𝐟𝐮𝐭𝐮𝐫𝐞 𝐨𝐟 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐢𝐬𝐧’𝐭 𝐣𝐮𝐬𝐭 𝐚𝐛𝐨𝐮𝐭 𝐫𝐞𝐬𝐩𝐨𝐧𝐝𝐢𝐧𝐠 𝐭𝐨 𝐚𝐭𝐭𝐚𝐜𝐤𝐬—𝐢𝐭’𝐬 𝐚𝐛𝐨𝐮𝐭 𝐚𝐧𝐭𝐢𝐜𝐢𝐩𝐚𝐭𝐢𝐧𝐠 𝐭𝐡𝐞𝐦 𝐛𝐞𝐟𝐨𝐫𝐞 𝐭𝐡𝐞𝐲 𝐡𝐚𝐩𝐩𝐞𝐧.

In this insightful episode of , Kumar Ritesh, CEO & Founder of CYFIRMA, explores how intelligence agencies anticipate cyberattacks and what organizations can learn from intelligence-led approaches to cybersecurity.

From nation-state threats and threat intelligence to the evolving cyber threat landscape, the conversation offers valuable perspectives on why organizations need to move beyond traditional reactive security and embrace a more preemptive approach.

🎙️ 𝗪𝗮𝘁𝗰𝗵 𝘁𝗵𝗲 𝗳𝘂𝗹𝗹 𝗲𝗽𝗶𝘀𝗼𝗱𝗲: https://www.youtube.com/watch?v=n8DQHUWDK6A

𝐴 ℎ𝑖𝑔ℎ𝑙𝑦 𝑖𝑛𝑓𝑜𝑟𝑚𝑎𝑡𝑖𝑣𝑒 𝑐𝑜𝑛𝑣𝑒𝑟𝑠𝑎𝑡𝑖𝑜𝑛 𝑓𝑜𝑟 𝑐𝑦𝑏𝑒𝑟𝑠𝑒𝑐𝑢𝑟𝑖𝑡𝑦 𝑙𝑒𝑎𝑑𝑒𝑟𝑠, 𝑠𝑒𝑐𝑢𝑟𝑖𝑡𝑦 𝑝𝑟𝑜𝑓𝑒𝑠𝑠𝑖𝑜𝑛𝑎𝑙𝑠, 𝑎𝑛𝑑 𝑎𝑛𝑦𝑜𝑛𝑒 𝑙𝑜𝑜𝑘𝑖𝑛𝑔 𝑡𝑜 𝑢𝑛𝑑𝑒𝑟𝑠𝑡𝑎𝑛𝑑 𝑤ℎ𝑎𝑡’𝑠 𝑛𝑒𝑥𝑡 𝑖𝑛 𝑡ℎ𝑒 𝑤𝑜𝑟𝑙𝑑 𝑜𝑓 𝑐𝑦𝑏𝑒𝑟 𝑡ℎ𝑟𝑒𝑎𝑡𝑠.

30/06/2026

🚀 𝐂𝐘𝐅𝐈𝐑𝐌𝐀 𝐚𝐭 𝐂𝐲𝐛𝐞𝐫 𝐅𝐢𝐫𝐬𝐭 𝐊𝐞𝐧𝐲𝐚 𝟐𝟎𝟐𝟔

We’re excited to announce that Cyfirma will be participating in Cyber First Kenya 2026, bringing together cybersecurity leaders, practitioners, and decision-makers to discuss the evolving threat landscape and strategies for cyber resilience across Africa.

We’re proud to share that Hamid Bafghi, Director for Sales & Partnerships – Middle East & Africa at CYFIRMA, will be among the distinguished speakers at the event.

🎤 Speaker: Hamid Bafghi
📍 Event: Cyber First Kenya 2026

Join Hamid as he shares insights on:

🔹 Emerging cyber threats targeting organizations across the region
🔹 The importance of external threat intelligence in proactive cyber defense
🔹 How organizations can strengthen cyber resilience through predictive, intelligence-led security

If you’re attending Cyber First Kenya 2026, we invite you to connect with our team, attend Hamid’s session, and discover how CYFIRMA helps organizations stay ahead of cyber adversaries through AI-powered external threat landscape management.

We look forward to connecting with cybersecurity professionals, partners, and industry leaders in Kenya.



Kumar Ritesh Dr. Saurabh Lal Anna Koh Philip Varughese Glaiza Pardilla Hamid Bafghi

02/06/2026

𝗧𝗼𝗸𝘆𝗼 — 𝗝𝘂𝗻 𝟮, 𝟮𝟬𝟮𝟲 — 𝗖𝗬𝗙𝗜𝗥𝗠𝗔 is pleased to announce that 𝐓𝐡𝐞 𝐊𝐚𝐧𝐬𝐚𝐢 𝐄𝐥𝐞𝐜𝐭𝐫𝐢𝐜 𝐏𝐨𝐰𝐞𝐫 𝐂𝐨𝐦𝐩𝐚𝐧𝐲, 𝐈𝐧𝐜𝐨𝐫𝐩𝐨𝐫𝐚𝐭𝐞𝐝 (𝐊𝐚𝐧𝐬𝐚𝐢 𝐄𝐥𝐞𝐜𝐭𝐫𝐢𝐜 𝐏𝐨𝐰𝐞𝐫) has adopted hashtag , our external threat landscape management platform. DeCYFIR provides comprehensive visualization of external cyber threats and risks, giving organizations the actionable intelligence needed to anticipate, prioritize, and defend against potential attacks.

𝗞𝗮𝗻𝘀𝗮𝗶 𝗘𝗹𝗲𝗰𝘁𝗿𝗶𝗰 𝗣𝗼𝘄𝗲𝗿 uses 𝗗𝗲𝗖𝗬𝗙𝗜𝗥 to map and monitor its external threat landscape, strengthen organizational cybersecurity posture, and proactively prepare for emerging risks. This partnership underscores the increasing need for energy-sector organizations to adopt external threat intelligence solutions that deliver context-rich visibility across open, deep, and dark web sources.

We look forward to supporting Kansai Electric Power with continuous threat monitoring, tailored risk insights, and collaborative threat-hunting capabilities to help protect critical infrastructure and maintain operational resilience.

Read the full announcement here:

Main article: Tokyo – Jun 2, 2026 – CYFIRMA (Headquarters: Chiyoda-ku, Tokyo; hereafter CYFIRMA), a provider of an external threat...

15/05/2026

➡️ 𝗛𝗼𝘄 “𝗔𝗜 𝗔𝗴𝗲𝗻𝘁𝘀” 𝗔𝗿𝗲 𝗧𝗿𝗮𝗻𝘀𝗳𝗼𝗿𝗺𝗶𝗻𝗴 𝗘𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲𝘀 🤖

𝗘𝘅𝗰𝗹𝘂𝘀𝗶𝘃𝗲 𝗜𝗻𝘁𝗲𝗿𝘃𝗶𝗲𝘄 with CYFIRMA’s CEO Kumar Ritesh on ITmedia Inc. Japan

In a new feature on ITmedia ビジネスオンライン, Cyfirma Founder & CEO Kumar Ritesh dives into how 𝗔𝗜 𝗮𝗴𝗲𝗻𝘁𝘀 are reshaping enterprise security and operations.

𝗞𝗲𝘆 𝘁𝗮𝗸𝗲𝗮𝘄𝗮𝘆𝘀:
✅ 𝗔𝗜 𝗮𝗴𝗲𝗻𝘁𝘀 go beyond traditional AI by perceiving, planning, and acting, not just predicting or generating outputs.
✅ When governed correctly, they become powerful 𝗳𝗼𝗿𝗰𝗲 𝗺𝘂𝗹𝘁𝗶𝗽𝗹𝗶𝗲𝗿𝘀 𝗳𝗼𝗿 𝗰𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆, automating threat‑hunting, response, and risk‑management workflows.
✅ At CYFIRMA, we’re turning this power into 𝗽𝗿𝗲𝗲𝗺𝗽𝘁𝗶𝘃𝗲 𝗰𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆: using AI‑driven intelligence to 𝗽𝗿𝗲𝗱𝗶𝗰𝘁 𝗮𝘁𝘁𝗮𝗰𝗸𝘀 𝗯𝗲𝗳𝗼𝗿𝗲 𝘁𝗵𝗲𝘆 𝗵𝗮𝗽𝗽𝗲𝗻 𝗮𝗻𝗱 𝗱𝗶𝘀𝗿𝘂𝗽𝘁 𝘁𝗵𝗿𝗲𝗮𝘁𝘀 𝗳𝗿𝗼𝗺 𝘁𝗵𝗲 𝗮𝘁𝘁𝗮𝗰𝗸𝗲𝗿’𝘀 𝗽𝗲𝗿𝘀𝗽𝗲𝗰𝘁𝗶𝘃𝗲.

As enterprises rapidly adopt AI‑enabled workflows, 𝗵𝗮𝘃𝗶𝗻𝗴 𝗽𝗿𝗼𝗮𝗰𝘁𝗶𝘃𝗲, 𝗶𝗻𝘁𝗲𝗹𝗹𝗶𝗴𝗲𝗻𝗰𝗲‑𝗹𝗲𝗱 𝗱𝗲𝗳𝗲𝗻𝘀𝗲𝘀 𝗶𝘀 𝗻𝗼 𝗹𝗼𝗻𝗴𝗲𝗿 𝗼𝗽𝘁𝗶𝗼𝗻𝗮𝗹.

➡️ Read the full article on ITmedia Japan to see how AI agents are changing the game and how CYFIRMA is helping organizations stay ahead of the curve.

https://www.itmedia.co.jp/business/articles/2605/15/news010.html

AIの新たな使い方として注目される「AIエージェント」。企業の一員として、自律的に業務を遂行するようになる可能性もある。一方、サイバー攻撃者も高度なAIを武器として使い始めており、攻めと守りの両面でAIをうまく....

13/04/2026

At , we don’t believe in waiting for attacks to happen. We believe in stopping them before they even begin.

Today marks a bold step forward as we deepen our commitment to the ANZ region, bringing the full force of our AI-powered DeCYFIR platform and its 9-pillar intelligence architecture to organizations that refuse to operate in the dark. Because here’s the reality: The most dangerous threats are no longer inside your perimeter. They are forming outside, across the open web, the dark web, and complex third-party ecosystems, long before a single alert is triggered.

𝐀𝐧𝐝 𝐫𝐞𝐚𝐜𝐭𝐢𝐧𝐠 𝐢𝐬 𝐧𝐨 𝐥𝐨𝐧𝐠𝐞𝐫 𝐞𝐧𝐨𝐮𝐠𝐡.

With , we are giving organizations the power to see what others can’t. To anticipate what others miss. And to act before damage is done.

This moment is also defined by leadership.

We are proud to welcome Rajeev Mathur as VP of Sales for ANZ, a leader who understands not just the market, but the urgency of the mission. His experience, combined with our strong regional team, will accelerate our vision of building a truly intelligence-led cyber ecosystem across ANZ.

𝐑𝐞𝐚𝐝 𝐭𝐡𝐞 𝐅𝐔𝐋𝐋 𝐀𝐧𝐧𝐨𝐮𝐧𝐜𝐞𝐦𝐞𝐧𝐭 𝐇𝐞𝐫𝐞

👉 https://www.cyfirma.com/news/cyfirma-deepens-anz-commitment-with-decyfirs-9-pillar-intelligence-architecture-and-new-regional-leadership-appointment/