New York, United States, October 28th, 2026 — CyberNewswire
A major advancement in cybersecurity training has arrived with the introduction of an interactive hands-on lab focused on the exploitation of the critical "PHP2Shell" vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Developed by OffSec, a leading provider of cybersecurity training, this free lab is part of the Proving Grounds Play (PG Play) platform. With the landscape of vulnerability discovery increasingly reshaped by AI-enhanced research methodologies, this initiative offers security practitioners a valuable opportunity to engage with these vulnerabilities on a practical level.
The PHP2Shell vulnerabilities target foundational flaws in PHP, the programming language that underpins approximately 70% of all websites with known server-side languages. These vulnerabilities have lingered in the code for well over a decade without significant attention, until recently, when researchers from Wiz, a cloud security firm owned by Google, turned their AI capabilities toward the PHP codebase. This innovative approach led to the discovery of the first vulnerability on August 19; just a day later, the researchers successfully compromised a Drupal site without requiring any passwords, and the following day, similar exploits were executed on WordPress.
The severity of these vulnerabilities led PHP to officially disclose them on October 21. Both CVEs are marked as severe, with attackers needing only a crafted series of web requests to exploit the vulnerabilities, potentially allowing them to either crash servers or fully take over control. Despite their complexity ratings suggesting a challenging exploitation process, active exploits were confirmed soon after their announcement, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to recommend that organizations patch their systems immediately.
According to reports from Amazon, PHP2Shell is engagingly popular among attackers, with evidence showing that by October 24, researchers identified active exploitation occurring on vulnerable honeypot servers. CISA promptly included both vulnerabilities on its Known Exploited Vulnerabilities catalog on October 26, highlighting the urgency of the situation.
Keegan Bowen, the principal DevOps lead at OffSec, remarked on the attractiveness of PHP to attackers, stating, “It has been a great attack vector over the years with many exploits and potential abuses. PHP wasn’t designed with security from the start.” In response to these vulnerabilities and the increasing reliance on AI in cybersecurity, OffSec has rolled out its PHP2Shell lab within PG Play. This lab aims to immerse penetration testers and security professionals in a controlled environment where they can explore the intricacies of CVE-2026-109618 and CVE-2026-109619.
With a critical severity rating of 9.2 out of 10, the flaws underscore the vulnerabilities inherent in PHP’s memory management—a factor that researchers indicated can pose significant challenges. The vulnerabilities stem from the manner in which PHP responds to requests that lead to memory exhaustion or fatal errors. Bowen elaborated on this, explaining that “some out-of-memory states were not handled well," allowing for unauthorized access to data before it could be properly cleared. This lingering data state can be exploited by an attacker, enabling them to execute code with the privileges of the web server.
Moreover, Wiz researchers revealed that these vulnerabilities could potentially allow attackers to read sensitive memory data from the PHP process, risking exposure of passwords, session tokens, API keys, and even certificates associated with other requests or the server itself.
As the scrutiny surrounding these vulnerabilities continues, the situation remains fluid. Notably, PHP disclosed an additional flaw, CVE-2026-115560, on October 23, which could impact even fully patched servers under specific session configurations. As awareness of vulnerabilities grows, more exploits have shown the capacity to bypass Address Space Layout Randomization (ASLR), a common memory defense. Consequently, new vulnerabilities, methods of exploitation, and corresponding mitigations are likely to emerge as ongoing research furthers understanding of PHP’s core security flaws.
To aid organizations in addressing these vulnerabilities, OffSec has provided a set of recommendations, emphasizing the need for immediate action. It is critical for users to update to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to mitigate the threats posed by CVE-2026-109618 and CVE-2026-109619. It is also crucial to ensure that the underlying PHP engines are updated, as merely updating applications like WordPress or Drupal does not address inherent vulnerabilities within PHP itself. Temporary protective measures, such as disabling PHP session upload progress and investigating potential signs of compromise, are advised while full patches are implemented.
As the cybersecurity landscape evolves, understanding the mechanics of these evolving exploits becomes essential to fortifying defenses. OffSec’s PHP2Shell lab is designed to empower practitioners, transitioning theoretical knowledge into practical skills that will be invaluable in responding to future vulnerabilities. For those wishing to delve deeper, OffSec offers a technical analysis of the vulnerabilities, along with various workforce development programs, aimed at enhancing the skills of security teams in the enterprise.
In conclusion, the recent developments surrounding PHP2Shell reflect a pressing need for continuous learning and adaptation in the cybersecurity realm. As the exploitation of vulnerabilities accelerates, so too must the response strategies of security teams worldwide.