Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
北 연계 의심 해킹조직, PHP 취약점 공격 준비 정황…정부·금융 타깃 | 한국경제
Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T133450Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Korea Economic Daily (Korean), 24 October: reconnaissance activity exploiting PHP2Shell spotted in a closed network. It reports that the Singapore thr...
What it says, as the collector read it
北 연계 의심 해킹조직, PHP 취약점 공격 준비 정황…정부·금융 타깃 | 한국경제
Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page kr/news/hankyung/article-2026102423207, snapshot 20261024T133450Z. Copied byte for byte; every file's sha256 is in captures/20261024T133450Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Curator's reading of the capture._
Korea Economic Daily (Korean), 24 October: reconnaissance activity exploiting PHP2Shell spotted in a closed network. It reports that the Singapore threat-intelligence firm Cyfirma saw Korean-speaking members in a private channel on the anonymous I2P network planning attacks on web servers worldwide; a possible link to a North Korean hacking group is raised, but direct proof has not been obtained. This is the same Cyfirma report as the EBN piece in the vault, so the two Korean outlets are one source, not two.
> 폐쇄망서 'PHP2Shell' 악용 정찰 활동 포착
_Curator's translation:_ "Reconnaissance activity exploiting 'PHP2Shell' spotted in a closed network"
Why it is here
From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "北 연계 의심 해킹조직, PHP 취약점 공격 준비 정황…정부·금융 타깃 | 한국경제". Selected mechanically, not read by a person.
Capture notes
Language ko. Nothing in the page addresses an AI or hides text from a reader.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261024T133450Z · HTTP 200 · https://www.hankyung.com/article/2026102423207
headers.json4f66c884c3592b6701c47dd1d8a9bdb30e409bca8fab57f9887915f899546052 471 bytespage.htmle4bffbd69eead0a1a760d581a330a26e6bc1ff7f711725841ad5dd6da448ed43 99,338 bytesprovenance.jsonbc1e3d4cdfc8562700fcac9e8f1ff65156ab4e2e574ffd1927b83ee8eabfc316 1,615 bytesrendered.htmle7a1561f51a0a6709558a29b4fff05e6e58015b8a5426cbf5cb0af359dc51c2b 218,173 bytesscreenshot.jpgbd1b4f549a4fdb7b177506b0ac650d0df994ef7f5b458d3366996d0f487e82ec 322,131 bytestext.txt45e966bc2d1e536c2425f5330889db94abff79d1612b22589b95648277284a1c 7,407 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →