· · · ·

Information War Update Oct 25, 2026: North Korea PHP Target List

Information war news: North Korea-linked hackers list PHP targets led by South Korea, Hong Kong warns of fake HIV alerts and Ukraine rebuts a biolab claim.

ByPeter Updated
Information war map for Oct 25, 2026 marking Seoul, Hong Kong, Kyiv and Moscow
Places named in this report, Oct 24–25, 2026; markers are approximate. Map: Peter's World; data: Natural Earth

Information War · at a glance

  • 2fronts covered
  • 25cited sources

Key Takeaways: 3 things to know

  1. Researchers said North Korea-linked hackers drew up a PHP2Shell target list with South Korean government and finance servers at the top (see Cyber Front).
  2. Hong Kong’s Department of Health said its HIV testing website’s email account sent false messages telling people they were exposed to HIV (see Cyber Front).
  3. Ukraine’s Center for Strategic Communications rejected a renewed Russian Foreign Ministry claim of secret US military biolabs in Ukraine (see Russian Claims).
Report detailsDetails
  • North Korea-linked hackers draw up a PHP target list led by South Korea, Hong Kong warns of fake HIV alerts, and Ukraine rebuts a Russian biolab claim.
Information war map for Oct 25, 2026 marking Seoul, Hong Kong, Kyiv and Moscow.
Places named in this report, Oct 24–25, 2026; markers are approximate. Map: Peter’s World; data: Natural Earth

This information war update for October 25, 2026, covers a reported North Korean target list for the PHP2Shell flaws, false HIV exposure messages sent from a Hong Kong health website and a renewed Russian biolab claim against Ukraine and the United States.[1] It follows the October 24 information war update, was written after the fact on October 30 from sources dated no later than October 25, and is followed by the October 26 update.[2]

Cyber Front

CYFIRMA, a Singapore-based threat intelligence firm, said two Korean-speaking operators discussed attack plans for 31 minutes on a private channel of the anonymous I2P network on October 22, Aju Press reported.[10] The conversation listed 15 server addresses prepared for attacks and sorted targets into three tiers, with government agencies and financial institutions in South Korea, the United States, Japan, the United Arab Emirates, the European Union, Thailand, Indonesia and Saudi Arabia at the top.[11] CYFIRMA said the group excluded servers patched on October 21 and planned to review its list again on October 25.[12] Amazon’s security team detected the first PHP2Shell attack attempt on October 17, according to the report.[13]

Hong Kong’s Department of Health said on October 24 that emails and text messages sent from its HIV Testing Service website wrongly told recipients they had been exposed to HIV.[14] The department said it found no evidence of data loss so far, reported the case to police and told the public not to click links in such messages.[15]

Russian Claims

Russia’s Foreign Ministry said the United States and Ukraine are hiding military biological activity on Ukrainian territory, Ukraine’s Center for Strategic Communications said on October 24.[16] The center said Moscow has used the biolab theme for years to discredit Ukraine and the United States without evidence.[17]

Fact-checks of viral claims

  • False: 1
  • Unverified: 1
Fact-checks of viral claims
DateClaimWho said itVerdictEvidenceSource(s)
2026-10-23/24Recipients were exposed to HIV and should get testedMessages sent from the Hong Kong HIV Testing Service website's email accountFalseThe Department of Health said the messages were wrongly sent and it does not notify people this waynews.gov.hk [19]
2026-10-24The US and Ukraine are hiding military biological activity in UkraineRussian Foreign MinistryUnsupportedNo evidence offered; Ukraine’s Center for Strategic Communications says official demands for explanations are not proofinform.zp.ua [18]

Date = date the claim was checked. Verdicts follow the cited fact-checkers and official records; “Unattributed viral post” means the report names no original author. Full citations are in the footnotes.

Domestic Affairs

No new US government action on information operations was found in sources dated October 24 or 25. The October 26 update covers congressional demands over Starlink limits made on October 25.[20]

War Crimes and Civilian Harm

Allegations are attributed; findings are not established unless stated.

No information-war items involving civilian harm were found in the window.[21]

Statements by Officials

United States statements come first; statements by other governments, companies and state-linked voices follow and are labeled. Quotes are verbatim and attributed.

United States

No US official statements on information operations were found in sources dated October 24 or 25.[22]

Other governments

Quotes: Other governments
DateSpeakerRole/OrgQuoteContext/TopicSource
2026-10-24Center for Strategic CommunicationsUkrainian government“Statements by Russian officials and demands for official explanations are not evidence that such activity exists”Russian biolab claim (translated)inform.zp.ua [23]

What to Watch

  • Whether CYFIRMA’s reported target list leads to confirmed attacks on South Korean or US government servers.
  • Whether Hong Kong’s investigation finds how the HIV website’s email account was misused.

Seven lenses

Analysis

About the framework

Geography & Strategic Position

South Korea tops a reported North Korean list of targets for the PHP2Shell flaws, ahead of government and finance targets in the United States, Japan, the European Union and the Gulf (see Cyber Front).[3]

Military & Security

CYFIRMA said the operators plan to use existing attack code and to avoid servers with strong security monitoring, Aju Press reported.[4]

Score 2/5Evidence confidence: LowTrend: Deteriorating

Alliances & Diplomatic Networks

Russia’s Foreign Ministry again accused the United States and Ukraine of hiding military biological work, a claim that targets both partners at once (see Russian Claims).[5]

Economic & Industrial Power

The reported target list includes online payment and trading platforms, shipping, logistics and aviation, Aju Press reported.[6]

Score 2/5Evidence confidence: LowTrend: Stable

Technology & Critical Infrastructure

Hong Kong’s Department of Health said the email account of its HIV Testing Service website was likely misused to send false exposure warnings (see Cyber Front).[7]

Domestic Politics & Information

Ukraine’s Center for Strategic Communications said Russian officials’ demands for explanations are not evidence that any biolabs exist (see Russian Claims).[8]

Strategic Leverage & Outcomes

Assessment: The reported North Korean list puts US government and finance servers in the top tier, so unpatched PHP servers remain a direct US exposure.[9]

Score 2/5Evidence confidence: LowTrend: Deteriorating

Strategic assessment

Relative advantage
A PHP security update has been available since October 21.
Critical vulnerability
PHP versions older than 8.1 have no official security update, Aju Press reported.
Decisive uncertainty
Whether the reported target list turns into attacks.
Likely trajectory
More scanning and attempts against unpatched PHP servers.
Strategic outcome
Not yet determinable.

Analysis by Peter’s World using the Seven Lenses framework. Numbered notes link to the footnotes at the end of this report. Scores, where shown, are judgments, not measurements.

Additional sources

Footnotes

  1. [1] Aju Press, “North Korean Hackers Prepare PHP Attacks Targeting South Korean Government and Finance”, https://www.ajupress.com/view/20261025180070375. Published: Oct 25, 2026, 5:00 AM ET (18:00 Seoul). Retrieved: 2026-10-30. Cites CYFIRMA (rendered ‘Cipherma’ in Aju Press’s AI translation). English text machine-translated by the publisher.
  2. [2] Peter’s World, “Source notes, Oct 25 Information War backfill”, https://petersworld.org/war-room/. Published: Published Oct 30, 2026, dated Oct 25. Retrieved: 2026-10-30. Written on Oct 30 using only events and sources dated on or before Oct 25, 2026; it was a weekend with few new information-war reports.
  3. [3] Aju Press, “North Korean Hackers Prepare PHP Attacks Targeting South Korean Government and Finance”, https://www.ajupress.com/view/20261025180070375. Published: Oct 25, 2026, 5:00 AM ET (18:00 Seoul). Retrieved: 2026-10-30. Cites CYFIRMA (rendered ‘Cipherma’ in Aju Press’s AI translation). English text machine-translated by the publisher.
  4. [4] Aju Press, “North Korean Hackers Prepare PHP Attacks Targeting South Korean Government and Finance”, https://www.ajupress.com/view/20261025180070375. Published: Oct 25, 2026, 5:00 AM ET (18:00 Seoul). Retrieved: 2026-10-30. Cites CYFIRMA (rendered ‘Cipherma’ in Aju Press’s AI translation). English text machine-translated by the publisher.
  5. [5] Inform.zp.ua, “Росія поширює фейк про американські біолабораторії в Україні: що відомо (Russia spreads fake about American biolabs in Ukraine)”, https://www.inform.zp.ua/uk/2026/10/24/400524_rosiya-poshyryuye-fejk-pro-amerykanski-biolaboratoriyi-v-ukrayini-shho-vidomo/. Published: Oct 24, 2026, 8:11 AM ET (3:11 PM Kyiv). Retrieved: 2026-10-30. Ukrainian-language; reports Ukraine’s Center for Strategic Communications. Summary in our words.
  6. [6] Aju Press, “North Korean Hackers Prepare PHP Attacks Targeting South Korean Government and Finance”, https://www.ajupress.com/view/20261025180070375. Published: Oct 25, 2026, 5:00 AM ET (18:00 Seoul). Retrieved: 2026-10-30. Cites CYFIRMA (rendered ‘Cipherma’ in Aju Press’s AI translation). English text machine-translated by the publisher.
  7. [7] news.gov.hk (Hong Kong government Information Services Department), “Public alerted to fake messages”, https://www.news.gov.hk/eng/2026/10/20261024/20261024_143207_875.html. Published: Oct 24, 2026, 4:51 AM ET (4:51 PM Hong Kong). Retrieved: 2026-10-30. Department of Health statement.
  8. [8] Inform.zp.ua, “Росія поширює фейк про американські біолабораторії в Україні: що відомо (Russia spreads fake about American biolabs in Ukraine)”, https://www.inform.zp.ua/uk/2026/10/24/400524_rosiya-poshyryuye-fejk-pro-amerykanski-biolaboratoriyi-v-ukrayini-shho-vidomo/. Published: Oct 24, 2026, 8:11 AM ET (3:11 PM Kyiv). Retrieved: 2026-10-30. Ukrainian-language; reports Ukraine’s Center for Strategic Communications. Summary in our words.
  9. [9] Aju Press, “North Korean Hackers Prepare PHP Attacks Targeting South Korean Government and Finance”, https://www.ajupress.com/view/20261025180070375. Published: Oct 25, 2026, 5:00 AM ET (18:00 Seoul). Retrieved: 2026-10-30. Cites CYFIRMA (rendered ‘Cipherma’ in Aju Press’s AI translation). English text machine-translated by the publisher.
Show 16 more sources
  1. [10] Aju Press, “North Korean Hackers Prepare PHP Attacks Targeting South Korean Government and Finance”, https://www.ajupress.com/view/20261025180070375. Published: Oct 25, 2026, 5:00 AM ET (18:00 Seoul). Retrieved: 2026-10-30. Cites CYFIRMA (rendered ‘Cipherma’ in Aju Press’s AI translation). English text machine-translated by the publisher.
  2. [11] Aju Press, “North Korean Hackers Prepare PHP Attacks Targeting South Korean Government and Finance”, https://www.ajupress.com/view/20261025180070375. Published: Oct 25, 2026, 5:00 AM ET (18:00 Seoul). Retrieved: 2026-10-30. Cites CYFIRMA (rendered ‘Cipherma’ in Aju Press’s AI translation). English text machine-translated by the publisher.
  3. [12] Aju Press, “North Korean Hackers Prepare PHP Attacks Targeting South Korean Government and Finance”, https://www.ajupress.com/view/20261025180070375. Published: Oct 25, 2026, 5:00 AM ET (18:00 Seoul). Retrieved: 2026-10-30. Cites CYFIRMA (rendered ‘Cipherma’ in Aju Press’s AI translation). English text machine-translated by the publisher.
  4. [13] Aju Press, “North Korean Hackers Prepare PHP Attacks Targeting South Korean Government and Finance”, https://www.ajupress.com/view/20261025180070375. Published: Oct 25, 2026, 5:00 AM ET (18:00 Seoul). Retrieved: 2026-10-30. Cites CYFIRMA (rendered ‘Cipherma’ in Aju Press’s AI translation). English text machine-translated by the publisher.
  5. [14] news.gov.hk (Hong Kong government Information Services Department), “Public alerted to fake messages”, https://www.news.gov.hk/eng/2026/10/20261024/20261024_143207_875.html. Published: Oct 24, 2026, 4:51 AM ET (4:51 PM Hong Kong). Retrieved: 2026-10-30. Department of Health statement.
  6. [15] news.gov.hk (Hong Kong government Information Services Department), “Public alerted to fake messages”, https://www.news.gov.hk/eng/2026/10/20261024/20261024_143207_875.html. Published: Oct 24, 2026, 4:51 AM ET (4:51 PM Hong Kong). Retrieved: 2026-10-30. Department of Health statement.
  7. [16] Inform.zp.ua, “Росія поширює фейк про американські біолабораторії в Україні: що відомо (Russia spreads fake about American biolabs in Ukraine)”, https://www.inform.zp.ua/uk/2026/10/24/400524_rosiya-poshyryuye-fejk-pro-amerykanski-biolaboratoriyi-v-ukrayini-shho-vidomo/. Published: Oct 24, 2026, 8:11 AM ET (3:11 PM Kyiv). Retrieved: 2026-10-30. Ukrainian-language; reports Ukraine’s Center for Strategic Communications. Summary in our words.
  8. [17] Inform.zp.ua, “Росія поширює фейк про американські біолабораторії в Україні: що відомо (Russia spreads fake about American biolabs in Ukraine)”, https://www.inform.zp.ua/uk/2026/10/24/400524_rosiya-poshyryuye-fejk-pro-amerykanski-biolaboratoriyi-v-ukrayini-shho-vidomo/. Published: Oct 24, 2026, 8:11 AM ET (3:11 PM Kyiv). Retrieved: 2026-10-30. Ukrainian-language; reports Ukraine’s Center for Strategic Communications. Summary in our words.
  9. [18] Inform.zp.ua, “Росія поширює фейк про американські біолабораторії в Україні: що відомо (Russia spreads fake about American biolabs in Ukraine)”, https://www.inform.zp.ua/uk/2026/10/24/400524_rosiya-poshyryuye-fejk-pro-amerykanski-biolaboratoriyi-v-ukrayini-shho-vidomo/. Published: Oct 24, 2026, 8:11 AM ET (3:11 PM Kyiv). Retrieved: 2026-10-30. Ukrainian-language; reports Ukraine’s Center for Strategic Communications. Summary in our words.
  10. [19] news.gov.hk (Hong Kong government Information Services Department), “Public alerted to fake messages”, https://www.news.gov.hk/eng/2026/10/20261024/20261024_143207_875.html. Published: Oct 24, 2026, 4:51 AM ET (4:51 PM Hong Kong). Retrieved: 2026-10-30. Department of Health statement.
  11. [20] Peter’s World, “Information War Update Oct 26, 2026: Trump Calls Brazil Vote Rigged”, https://petersworld.org/information-war-update-oct-26/. Published: Oct 26, 2026. Retrieved: 2026-10-30.
  12. [21] Peter’s World, “Source notes, Oct 25 Information War backfill”, https://petersworld.org/war-room/. Published: Published Oct 30, 2026, dated Oct 25. Retrieved: 2026-10-30. Written on Oct 30 using only events and sources dated on or before Oct 25, 2026; it was a weekend with few new information-war reports.
  13. [22] Peter’s World, “Source notes, Oct 25 Information War backfill”, https://petersworld.org/war-room/. Published: Published Oct 30, 2026, dated Oct 25. Retrieved: 2026-10-30. Written on Oct 30 using only events and sources dated on or before Oct 25, 2026; it was a weekend with few new information-war reports.
  14. [23] (statement) Inform.zp.ua, “Росія поширює фейк про американські біолабораторії в Україні: що відомо (Russia spreads fake about American biolabs in Ukraine)”, https://www.inform.zp.ua/uk/2026/10/24/400524_rosiya-poshyryuye-fejk-pro-amerykanski-biolaboratoriyi-v-ukrayini-shho-vidomo/. Statement made Oct 24, 2026 (Ukraine’s Center for Strategic Communications); published Oct 24, 2026, 8:11 AM ET. Retrieved: 2026-10-30. Quote translated from Ukrainian by Peter’s World.
  15. [24] Peter’s World, “Information War Update Oct 24, 2026: Internet Freedom Falls 16th Year”, https://petersworld.org/information-war-update-oct-24/. Published: Oct 24, 2026. Retrieved: 2026-10-30.
  16. [25] Peter’s World, “Seven Lenses of Geopolitical Power”, https://petersworld.org/seven-lenses-of-geopolitical-power/. Published: 2026. Retrieved: 2026-10-30.

Sources

Related coverage

More from the War Room today

Related on Peter’s World

Recommended articles