CriticalBreach
OffSec Launches Free PHP2Shell Lab Following Critical Vulnerability Discovery
Cyber Security News·Source published ·1 min read
What happened?
New York, United States, October 28th, 2026, CyberNewswire New hands-on lab lets security practitioners explore PHP2Shell exploitation firsthand as AI-assisted research reshapes vulnerability discovery. OffSec today announced the release of a free, interactive hands-on lab in Proving Grounds Play (PG Play) to help security practitioners examine and defend against the critical “PHP2Shell” vulnerabilities (CVE-2026-109618 and CVE-2026-109619) firsthand.
Key details
- OffSec released a free hands-on lab in Proving Grounds Play for the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.
- Both vulnerabilities allow unauthenticated attackers to crash or take over a server via crafted web requests.
- Active exploitation has been confirmed, with CISA adding both flaws to its Known Exploited Vulnerabilities catalog.
- Exploitation can leak sensitive memory contents such as passwords, session tokens, API keys, and certificates.
Affected
- PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are affected by CVE-2026-109618 and CVE-2026-109619.
- A separate flaw CVE-2026-115560 affects fully patched servers with an unusual session setup and has no fix yet.
Fixes and mitigations
- Rebuild container images and restart PHP processes so updated code takes effect.
- Disable PHP session upload progress (session.upload_progress.enabled=0) as a temporary mitigation.
- On PHP 8.5, disable fatal error backtraces and restart affected workers after configuration changes.
What to look for
- Suspicious multipart requests in web server and PHP logs.
- Repeated HTTP 500 responses.
- Malformed session cookies.
- Unexpected PHP worker restarts.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.