OffSec Launches Free PHP2Shell Lab Following Critical Vulnerability Discovery

New hands-on lab lets security practitioners explore PHP2Shell exploitation firsthand as AI-assisted research reshapes vulnerability discovery.

OffSec today announced the release of a free, interactive hands-on lab in Proving Grounds Play (PG Play) to help security practitioners examine and defend against the critical “PHP2Shell” vulnerabilities (CVE-2026-109618 and CVE-2026-109619) firsthand. Developed in response to AI-accelerated vulnerability discovery and active exploits targeting core PHP engines in the wild, the lab provides penetration testers and enterprise defenders with a safe, controlled environment to study the decade-old memory corruption flaws and implement timely server mitigations.

The two critical flaws sat inside PHP, the language behind roughly 70% of websites whose server-side language is known, for more than a decade. Then researchers at Wiz, a Google-owned cloud security company, pointed AI at the code. 

They found the first flaw Aug. 19. The next day they used it to take over a Drupal site without a password. The day after that, it worked on WordPress.

PHP disclosed the flaws Oct. 21 as CVE-2026-109618 and CVE-2026-109619. An attacker with no login can send a series of crafted web requests to crash a server or take it over. PHP’s severity scores rate both vulnerabilities as complex to exploit, even though working attacks already existed. The Cybersecurity and Infrastructure Security Agency (CISA) recommends patching immediately. 

Attackers are moving fast. Amazon calls PHP2Shell broadly exploited in the wild. By Oct.24, researchers had confirmed attackers running commands on vulnerable honeypot servers. CISA added both flaws to its Known Exploited Vulnerabilities catalog on Oct. 26. 

“PHP is one of those technologies attackers love to see,” said Keegan Bowen, principal DevOps lead at OffSec. “It has been a great attack vector over the years with many exploits and potential abuses. PHP wasn’t designed with security from the start.”

OffSec, which has taught hands-on offensive security since 2006, has released a free PHP2Shell lab in Proving Grounds Play (PG Play). The lab gives penetration testers and other security professionals a controlled environment to explore CVE-2026-109618 and CVE-2026-109619 firsthand. OffSec’s blog breaks down both flaws, and its proof-of-concept exploit is available on Exploit-DB. 

AI and the Evolving Pace of Exploitation

PHP scored both flaws 9.2 out of 10, a critical rating. To build a working attack, Wiz researchers had to chain several bugs together and tune the attack to each server’s memory. When they let AI do the grind, one researcher finished in a week what once took a top team month. Attackers can use the same AI models, so flaws once ranked too complex to matter are now fair game. 

“At this point, attackers are heavily leaning on AI to find and exploit vulnerabilities; the rate of CVEs is roughly double what was reported last year,” said Matt Freitas-Stavola, staff software engineer at OffSec. “LLMs don’t get tired and can easily run in the background for as long as attackers have money or compute to spare. Even now, just a hint of where an issue could arise is enough for an LLM to get a workable POC out relatively quickly.”

The Effects of These Flaws

Both flaws start with the same weak spot: what PHP does when a request runs out of memory or hits another fatal error.

“PHP is built from C and memory management becomes increasingly challenging as the code grows,” Bowen said. “Some out-of-memory states were not handled well. In some cases, attackers can access interrupted state data before it is cleaned up. That becomes an opportunity for abuse.”

That leftover state can carry into the next request on the same worker. An attacker who shapes it can run code with the web server’s privileges.

The same bugs can also leak data. Wiz showed attackers could potentially read memory from the PHP process. That memory could hold passwords, session tokens, API keys, and certificates from other requests or the server itself. 

The story is still developing. On Oct. 23, PHP disclosed a separate flaw, CVE-2026-115560, that can affect fully patched servers with an unusual session setup. PHP has no fix for it yet. Researchers have also built PHP2Shell exploits that get past ASLR, a common memory defense, and more issues could surface as the flaws are studied. As research continues, new vulnerabilities, exploitation techniques, and mitigations may emerge beyond those covered here.

OffSec’s Current Recommendations

These steps reflect what is known at the time of publication. Check CISA and the PHP project for the latest recommendations.

• Patch PHP Now. Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to address CVE-2026-109618 and CVE-2026-109619. Check vendor advisories rather than relying on version numbers alone.
• Update the Underlying PHP Engine. Updating WordPress, Drupal, or another application does not resolve vulnerabilities in PHP itself. Rebuild affected container images, and restart PHP processes so the updated code takes effect.
• Apply Temporary Protections While Patching. Disable PHP session upload progress (session.upload_progress.enabled=0), which also mitigates CVE-2026-115560. On PHP 8.5, disable fatal error backtraces and restart affected workers after configuration changes. These measures reduce exposure; they do not replace patching.
• Investigate Potential Compromise. Review web server and PHP logs for suspicious multipart requests, memory-limit errors, repeated HTTP 500 responses, malformed session cookies, and unexpected PHP worker restarts. Investigations should consider activity dating back to at least October 17, when exploitation attempts were first reported. Rotate potentially affected credentials, API keys, and tokens as appropriate.

Understand the Exploit. Strengthen the Defense.

When the next disclosure lands, someone on the team needs to judge exposure. Reading about an exploit builds awareness. Working on one hands-on builds the skill to respond. 

OffSec’s PHP2Shell lab helps practitioners turn technical knowledge into hands-on experience they can apply to future vulnerabilities. For a deeper look at the vulnerabilities, explore OffSec’s technical analysis. Organizations looking to build these capabilities across their security teams can explore OffSec’s workforce development programs.

About OffSec

OffSec is the world’s leading provider of high-fidelity cybersecurity training and certifications. Built on a foundation of excellence, integrity, and the relentless “Try Harder” ethos, OffSec empowers individuals and organizations to outsmart evolving cyber threats through rigorous, hands-on learning.

Contact

Press Team

OffSec

Kathryn@kbmediaconsulting.com