· ai-devtools
OffSec releases free PHP2Shell lab for practitioners to study CVE-2026-109618 and CVE-2026-109619
Attacks against core PHP engines in the wild are accelerating, prompting OffSec to release a complimentary, interactive lab in Proving Grounds Play (PG Play) so security professionals can directly…
Attacks against core PHP engines in the wild are accelerating, prompting OffSec to release a complimentary, interactive lab in Proving Grounds Play (PG Play) so security professionals can directly investigate and defend against the critical "PHP2Shell" vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
These two severe flaws resided within PHP, the underlying language for roughly 70% of websites whose server-side language is known, for over a decade. The situation escalated dramatically when researchers at Wiz, a cloud security company owned by Google, applied AI to the code. They uncovered the initial vulnerability on August 19th; the very next day, they demonstrated its ability to compromise a Drupal site without requiring a password, and the following day, it worked against WordPress. PHP officially disclosed these flaws on October 21st, assigning them the identifiers CVE-2026-109618 and CVE-2026-109619. An adversary lacking any credentials can transmit a sequence of specially crafted web requests to either crash a server or seize control of it. Despite working exploits already existing, PHP's own severity scoring rates both vulnerabilities as complex to exploit.
Amazon has labeled PHP2Shell as being widely exploited in real-world scenarios, and by October 24th, researchers had verified that attackers were successfully executing commands on vulnerable honeypot servers. Consequently, CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26th.
Keegan Bowen, principal DevOps lead at OffSec, remarked, "PHP is one of those technologies attackers love to see," adding that "It has been a great attack vector over the years with many exploits and potential abuses. PHP wasn't designed with security from the start." OffSec, which has been offering hands-on offensive security training since 2006, has now made available this free PHP2Shell lab in PG Play, offering penetration testers and other security experts a controlled setting to explore CVE-2026-109618 and CVE-2026-109619 firsthand. Furthermore, OffSec's blog details both flaws, and a proof-of-concept exploit is accessible on Exploit-DB.
The impact of artificial intelligence on exploitation speed is profound; PHP scored both flaws with a critical rating of 9.2 out of 10. To create a functional attack, the Wiz researchers needed to link several bugs together and fine-tune the attack for each specific server's memory. However, when they utilized AI for the intensive grinding process, one researcher achieved in a week what previously required a top team a full month. Since attackers can employ the same AI models, vulnerabilities once deemed too intricate to matter are now accessible targets. Matt Freitas-Stavola, staff software engineer at OffSec, stated, "At this point, attackers are heavily leaning on AI to find and exploit vulnerabilities; the rate of CVEs is roughly double what was reported last year." He elaborated that "LLMs don't get tired and can easily run in the background for as long as attackers have money or compute to spare. Even now, just a hint of where an issue could arise is enough for an LLM to get a workable POC out relatively quickly."
Both vulnerabilities originate from the same weakness: how PHP manages situations when a request exhausts its memory or encounters another critical error. Bowen explained that because "PHP is built from C and memory management becomes increasingly challenging as the code grows," certain out-of-memory conditions were not handled properly. In certain instances, attackers gain access to data from an interrupted state before it is properly cleared, creating an opening for misuse. This residual state can persist into the subsequent request handled by the same worker process. An attacker who manipulates this residue can then execute code using the web server's permissions. These same bugs also permit data leakage; Wiz demonstrated that attackers could potentially read memory from the PHP process, and this memory might contain sensitive information such as passwords, session tokens, API keys, or certificates from other requests or the server itself.
The situation remains fluid; on October 23rd, PHP disclosed a separate issue, CVE-2026-115560, which could affect servers that are fully patched but possess an unusual session configuration. As of now, PHP has not released a patch for this newer flaw. Researchers have also developed PHP2Shell exploits capable of bypassing ASLR, a standard memory defense, and more issues are expected to surface as the analysis of these flaws continues. As research progresses, novel exploitation methods, mitigations, and vulnerabilities beyond those detailed here may emerge.
OffSec's current guidance, which reflects the knowledge available at the time of this writing, suggests several actions. First, immediately apply patches: update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to resolve CVE-2026-109618 and CVE-2026-109619, while always consulting vendor advisories rather than depending solely on version numbers. Second, ensure the underlying PHP engine is updated; updating applications like WordPress or Drupal alone will not fix vulnerabilities within PHP itself, so affected container images must be rebuilt, and PHP processes restarted to enact the code changes. Third, implement temporary safeguards during the patching process: disabling PHP session upload progress (by setting `session.upload_progress.enabled=0`) also helps mitigate CVE-2026-115560, and on PHP 8.5, fatal error backtraces should be disabled and workers restarted after configuration modifications. These protective actions lessen risk but do not substitute for applying patches. Fourth, investigate potential breaches by scrutinizing web server and PHP logs for signs of suspicious multipart requests, memory-limit errors, recurring HTTP 500 responses, oddly formed session cookies, and unexpected restarts of PHP workers. These investigations should examine activity dating back to at least October 17th, when exploitation attempts were initially reported, and appropriate credentials, API keys, and tokens should be rotated.
Understanding the exploit and strengthening defenses are crucial; when the next disclosure occurs, a team member must assess the level of exposure. Reading about an exploit raises awareness, but engaging with one hands-on builds the necessary skill set to react to future vulnerabilities. OffSec's PHP2Shell lab assists practitioners in transforming theoretical knowledge into practical, applicable experience for confronting upcoming vulnerabilities. For a deeper dive into the technical analysis of these flaws, one can review OffSec's detailed technical breakdown. Organizations aiming to cultivate these competencies across their security teams are invited to look into OffSec's workforce development programs.
OffSec stands as the premier global provider of high-fidelity cybersecurity training and certifications. Built upon a bedrock of integrity, excellence, and the unwavering "Try Harder" philosophy, OffSec empowers both individuals and organizations to outmaneuver evolving cyber threats through rigorous, practical instruction. Contact Press Team OffSec Kathryn@kbmediaconsulting.com
Why it matters
This news highlights the severe, active threat posed by memory corruption flaws in widely used PHP, impacting nearly 70% of websites. Developers must prioritize patching to mitigate risks, especially given that AI is accelerating the discovery and exploitation of such vulnerabilities.
