Security professionals now have access to a complimentary, interactive lab within Proving Grounds Play (PG Play) provided by OffSec, enabling them to examine and defend against the critical "PHP2Shell" vulnerabilities, specifically CVE-2026-109618 and CVE-2026-109619. This lab was created in response to the acceleration of vulnerability discovery aided by artificial intelligence and active exploitation targeting fundamental PHP engines in the field. The purpose of this controlled, safe setting is to allow penetration testers and enterprise defenders to study the long-standing memory corruption issues and implement necessary server safeguards. These two severe defects resided within PHP, the underlying language for approximately 70% of websites utilizing a server-side language, for more than a decade.
Researchers at Wiz, a cloud security firm owned by Google, initiated the discovery by applying AI to the codebase, locating the initial flaw on August 19th. The subsequent day saw its use in compromising a Drupal website without requiring a password, followed by a successful demonstration on WordPress the following day. PHP officially disclosed these weaknesses on October 21st, cataloging them as CVE-2026-109618 and CVE-2026-109619. An adversary lacking any form of credentials can transmit a sequence of specially constructed web requests to either crash a server or achieve full control over it. Despite existing functional attacks, PHP's own severity ratings assigned both vulnerabilities a complexity level, deeming them difficult to exploit. The Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive mandating immediate patching.
Attackers are progressing rapidly; by October 24th, researchers had verified instances of attackers executing commands on compromised honeypot servers. Furthermore, CISA incorporated both vulnerabilities into its catalog of Known Exploited Vulnerabilities on October 26th. "PHP is one of those technologies attackers love to see," stated Keegan Bowen, principal DevOps lead at OffSec. He added that, "It has been a great attack vector over the years with many exploits and potential abuses. PHP wasn't designed with security from the start." OffSec, which has been offering hands-on offensive security instruction since 2006, has therefore released this free PHP2Shell lab in Proving Grounds Play (PG Play), granting penetration testers and other security specialists a controlled environment to explore CVE-2026-109618 and CVE-2026-109619 firsthand. OffSec’s blog provides a detailed breakdown of both flaws, and a proof-of-concept exploit is available on Exploit-DB.
The integration of AI and the accelerating speed of exploitation are significant factors here. PHP scored both flaws with a critical rating of 9.2 out of 10. To construct a viable attack, the Wiz researchers needed to link several bugs together and fine-tune the attack specifically for each server's memory configuration. When AI was utilized for this process, one researcher completed in one week what previously required a top team a month. Since attackers can leverage the identical AI models, weaknesses previously considered too complex to be relevant are now targets. Matt Freitas-Stavola, staff software engineer at OffSec, commented, "At this point, attackers are heavily leaning on AI to find and exploit vulnerabilities; the rate of CVEs is roughly double what was reported last year. LLMs don't get tired and can easily run in the background for as long as attackers have money or compute to spare. Even now, just a hint of where an issue could arise is enough for an LLM to get a workable POC out relatively quickly."
These flaws originate from the same fundamental weakness: how PHP manages situations when a request exhausts memory or encounters another fatal error. Bowen explained that, "PHP is built from C and memory management becomes increasingly challenging as the code grows. Some out-of-memory states were not handled well. In some cases, attackers can access interrupted state data before it is cleaned up. That becomes an opportunity for abuse. That leftover state can carry into the next request on the same worker. An attacker who shapes it can run code with the web server's privileges." Additionally, these bugs possess the capability to leak sensitive data. Wiz demonstrated that attackers could potentially read the memory allocated to the PHP process, and this memory could contain data from other requests or the server itself, such as API keys, session tokens, certificates, and passwords. The situation remains dynamic; on October 23rd, PHP disclosed a separate vulnerability, CVE-2026-115560, which can affect fully patched servers configured with an unusual session setup, and currently, PHP lacks a remedy for this. Researchers have also developed PHP2Shell exploits capable of bypassing ASLR, a common memory defense, and further issues are expected to surface as the investigation into these flaws continues. As the research progresses, new exploitation techniques, mitigations, and vulnerabilities beyond those detailed here may emerge.
OffSec’s current directives, which are contingent upon the information available at this publication time, include several actions. First, one must Patch PHP Now by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to resolve CVE-2026-109618 and CVE-2026-109619; advisories from vendors should be consulted rather than solely depending on version numbers. Second, one must Update the Underlying PHP Engine, noting that updating applications like WordPress or Drupal will not fix vulnerabilities within PHP itself; affected container images must be rebuilt, and PHP processes restarted for the new code to take effect. Third, Temporary Protections should be Applied While Patching, specifically by disabling PHP session upload progress (session.upload_progress.enabled=0), which also addresses CVE-2026-115560, and on PHP 8.5, disabling fatal error backtraces and restarting affected workers following configuration alterations. It must be stressed that these protective measures lessen risk but do not substitute for applying patches. Fourth, one should Investigate Potential Compromise by scrutinizing web server and PHP logs for indications of suspicious multipart requests, memory-limit errors, repeated HTTP 500 responses, abnormally formatted session cookies, and unexpected PHP worker restarts; these investigations should cover activity dating back to at least October 17th, when initial exploitation attempts were reported, and potentially necessitate rotating any credentials, API keys, or tokens that might have been exposed.
The value of understanding an exploit is in strengthening defenses. While reading about an exploit raises awareness, actively working through one builds the practical capability needed to respond to future vulnerabilities. OffSec's PHP2Shell lab assists practitioners in converting theoretical knowledge into hands-on experience applicable to forthcoming vulnerabilities. For a more in-depth examination of the vulnerabilities, one can consult OffSec’s technical analysis. Organizations aiming to cultivate these competencies across their security staff can explore OffSec’s workforce development programs.
The proliferation of AI in the discovery and exploitation lifecycle signifies a broader industry shift, as demonstrated by the rapid evolution from initial code discovery to active, scalable exploitation across widely used platforms like PHP.
OffSec is recognized globally as a premier supplier of high-fidelity cybersecurity training and certifications. Founded upon principles of excellence, integrity, and the unwavering "Try Harder" philosophy, OffSec enables both individuals and corporations to outmaneuver evolving cyber threats through rigorous, practical instruction. Contact Press Team OffSec Kathryn@kbmediaconsulting.com
Why it matters
This highlights the urgent operational risk posed by core infrastructure flaws, as attackers are rapidly leveraging AI to discover and exploit vulnerabilities. Operators must prioritize patching to mitigate the risk of server takeover or data leakage from these memory corruption issues.
