OffSec launches free PHP2Shell lab following critical vulnerability discovery. New hands-on lab lets security practitioners explore PHP2Shell exploitation firsthand as AI-assisted research reshapes vulnerability discovery. October 28, 2026 16:37 ET | Source: OffSec NEW YORK, Oct. 28, 2026 (GLOBE NEWSWIRE) - OffSec today announced the release of a free, interactive hands-on lab in Proving Grounds Play (PG Play) to help security practitioners examine and defend against the critical "PHP2Shell" vulnerabilities (CVE-2026-109618 and CVE-2026-109619) firsthand. Developed in response to AI-accelerated vulnerability discovery and active exploits targeting core PHP engines in the wild, the lab provides penetration testers and enterprise defenders with a safe, controlled environment to study the decade-old memory corruption flaws and implement timely server mitigations. The two critical flaws sat inside PHP, the language behind roughly 70% of websites whose server-side language is known, for more than a decade. Then researchers at Wiz, a Google-owned cloud security company, pointed AI at the code. They found the first flaw Aug. 19. The next day they used it to take over a Drupal site without a password. The day after that, it worked on WordPress. PHP disclosed the flaws Oct. 21 as CVE-2026-109618 and CVE-2026-109619. An attacker with no login can send a series of crafted web requests to crash a server or take it over. PHP's severity scores rate both vulnerabilities as complex to exploit, even though working attacks already existed. The Cybersecurity and Infrastructure Security Agency (CISA) recommends patching immediately. Attackers are moving fast. Amazon calls PHP2Shell broadly exploited in the wild. By Oct.24, researchers had confirmed attackers running commands on vulnerable honeypot servers. CISA added both flaws to its Known Exploited Vulnerabilities catalog on Oct. 26. "PHP is one of those technologies attackers love to see," said Keegan Bowen, principal DevOps lead at OffSec. "It has been a great attack vector over the years with many exploits and potential abuses. PHP wasn't designed with security from the start." OffSec, which has taught hands-on offensive security since 2006, has released a free PHP2Shell lab in Proving Grounds Play (PG Play). The lab gives penetration testers and other security professionals a controlled environment to explore CVE-2026-109618 and CVE-2026-109619 firsthand. OffSec's blog breaks down both flaws, and its proof-of-concept exploit is available on Exploit-DB. AI and the Evolving Pace of Exploitation PHP scored both flaws 9.2 out of 10, a critical rating. To build a working attack, Wiz researchers had to chain several bugs together and tune the attack to each server's memory. When they let AI do the grind, one researcher finished in a week what once took a top team month. Attackers can use the same AI models, so flaws once ranked too complex to matter are now fair game. "At this point, attackers are heavily leaning on AI to find and exploit vulnerabilities; the rate of CVEs is roughly double what was reported last year," said Matt Freitas-Stavola, staff software engineer at OffSec. "LLMs don't get tired and can easily run in the background for as long as attackers have money or compute to spare. Even now, just a hint of where an issue could arise is enough for an LLM to get a workable POC out relatively quickly." The Effects of These Flaws Both flaws start with the same weak spot: what PHP does when a request runs out of memory or hits another fatal error. "PHP is built from C and memory management becomes increasingly challenging as the code grows," Bowen said. "Some out-of-memory states were not handled well. In some cases, attackers can access interrupted state data before it is cleaned up. That becomes an opportunity for abuse." That leftover state can carry into the next request on the same worker. An attacker who shapes it can run code with the web server's privileges. The same bugs can also leak data. Wiz showed attackers could potentially read memory from the PHP process. That memory could hold passwords, session tokens, API keys, and certificates from other requests or the server itself. The story is still developing. On Oct. 23, PHP disclosed a separate flaw, CVE-2026-115560, that can affect fully patched servers with an unusual session setup. PHP has no fix for it yet. Researchers have also built PHP2Shell exploits that get past ASLR, a common memory defense, and more issues could surface as the flaws are studied. As research continues, new vulnerabilities, exploitation techniques, and mitigations may emerge beyond those covered here. OffSec's Current Recommendations These steps reflect what is known at the time of publication. Check CISA and the PHP project for the latest recommendations. * Patch PHP Now. Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to address CVE-2026-109618 and CVE-2026-109619. Check vendor advisories rather than relying on version numbers alone. * Update the Underlying PHP Engine. Updating WordPress, Drupal, or another application does not resolve vulnerabilities in PHP itself. Rebuild affected container images, and restart PHP processes so the updated code takes effect. * Apply Temporary Protections While Patching. Disable PHP session upload progress (session.upload_progress.enabled=0), which also mitigates CVE-2026-115560. On PHP 8.5, disable fatal error backtraces and restart affected workers after configuration changes. These measures reduce exposure; they do not replace patching. * Investigate Potential Compromise. Review web server and PHP logs for suspicious multipart requests, memory-limit errors, repeated HTTP 500 responses, malformed session cookies, and unexpected PHP worker restarts. Investigations should consider activity dating back to at least October 17, when exploitation attempts were first reported. Rotate potentially affected credentials, API keys, and tokens as appropriate. Understand the Exploit. Strengthen the Defense. When the next disclosure lands, someone on the team needs to judge exposure. Reading about an exploit builds awareness. Working on one hands-on builds the skill to respond. OffSec's PHP2Shell lab helps practitioners turn technical knowledge into hands-on experience they can apply to future vulnerabilities. For a deeper look at the vulnerabilities, explore OffSec's technical analysis. Organizations looking to build these capabilities across their security teams can explore OffSec's workforce development programs. About OffSec OffSec is the world's leading provider of high-fidelity cybersecurity training and certifications. Built on a foundation of excellence, integrity, and the relentless "Try Harder" ethos, OffSec empowers individuals and organizations to outsmart evolving cyber threats through rigorous, hands-on learning. Press Team OffSec

OffSec, the company behind the OSCP certification and Kali Linux, has launched a framework hub that maps its training to the main cyber workforce standards. The hub shows which courses, labs, and modules build the skills each role requires. It covers the NICE Workforce Framework for Cybersecurity, the US Department of Defense Cyber Workforce Framework, ENISA's European Cybersecurity Skills Framework, and the Saudi and Omani frameworks. Security leaders can plan training around existing roles and report progress to boards and regulators. The move follows a skills shortage: 59% of organisations report critical or significant cybersecurity skills gaps, according to the ISC2 2025 Cybersecurity Workforce Study. OffSec's Learn Enterprise subscription offers more than 8,000 hours of content.

Singapore: cybersecurity Training to strengthen digital resilience. Singapore Polytechnic has launched the Cybersecurity Assessment and Security Operations Centre Training Lab for Enterprises (CASTLE) programme to strengthen cybersecurity capabilities among students and enterprises. Speaking at the launch, Acting Minister for Manpower and Senior Minister of State, Ministry of Digital Development and Information, Ms Jasmin Lau, said the initiative reflects Singapore's broader efforts to prepare for growing digital risks through stronger partnerships, workforce development and practical industry experience. The programme combines classroom learning with internships and industry attachments, giving students opportunities to apply their knowledge in real-world settings. It also provides cybersecurity support services for enterprises, particularly small and medium-sized enterprises (SMEs), while helping educators stay connected with industry practice. Cybersecurity as a national resilience issue. In her address, Ms Lau said cybersecurity now extends beyond information technology departments and affects businesses, public services and public trust. Digital technologies are increasingly embedded across Singapore's economy and daily life, creating opportunities while also introducing greater vulnerabilities. She said the question is no longer whether cybersecurity is important, but how Singapore can prepare its people and organisations to respond to threats. Ms Lau highlighted three areas: building capabilities across the system, creating opportunities through partnerships and strengthening resilience across the wider digital ecosystem. Artificial intelligence (AI) is also changing the cybersecurity landscape. Ms Lau noted that AI is reshaping how people work, learn and innovate, while influencing cybersecurity practices used by both defenders and malicious actors. This makes a strong pipeline of cybersecurity-ready talent increasingly important. Hands-on training linked to industry practice. Ms Lau emphasised that cybersecurity is ultimately a hands-on profession and that practical experience cannot be fully replicated in a classroom. Students build confidence not only by learning concepts, but by responding to real incidents and working alongside practitioners. CASTLE is designed to bridge this gap between education and practice by combining classroom learning with internships and industry attachments. The programme will also help educators stay connected with industry and keep their skills current as technologies and cyber threats evolve. This approach is intended to ensure that students develop skills that are relevant to the operational demands they will face when entering the cybersecurity workforce. Partnerships for greater cyber resilience. Ms Lau said collaboration between government, academia and industry is essential because no single organisation has all the answers to increasingly interconnected cybersecurity challenges. She cited the global CrowdStrike outage in July 2024 as an example of the interconnected nature of digital infrastructure. Although the incident was not a cyber attack, it disrupted flights, healthcare services and business operations, demonstrating how disruption in one part of the ecosystem can quickly affect others. She said resilience must therefore be built collectively, with government providing guidance and good practices, industry contributing operational knowledge and academia developing talent and preparing students for future requirements. As part of CASTLE, Singapore Polytechnic will sign memoranda of understanding with industry partners including ST Engineering, OffSec and Athena Dynamics. The programme will also help lecturers maintain industry connections and gain real-world experience. Singapore's Cyber Security Agency (CSA) Cyber Essentials certification will support future engagements under CASTLE by providing organisations with a practical starting point for strengthening cybersecurity hygiene. Strengthening resilience across the digital economy. Ms Lau also highlighted the importance of cybersecurity for SMEs, which form the backbone of Singapore's economy. Strengthening an SME's cybersecurity can help protect not only the business itself, but also its customers, suppliers and business partners. CASTLE will make cybersecurity capabilities more accessible through cybersecurity clinics, Security Operations Centre services and student-led awareness programmes. These initiatives are intended to build confidence among SMEs while giving students further opportunities to apply their skills in practical settings. Ms Lau also stressed that while AI will continue to automate tasks, improve productivity and strengthen cybersecurity, technology cannot replace human qualities such as curiosity, judgement and shared responsibility. Building a cyber-resilient Singapore, she said, will continue to depend on people who keep learning, organisations that strengthen partnerships and institutions that invest in the next generation. CASTLE is therefore positioned as part of a wider effort to connect education, industry and government, strengthening Singapore's cybersecurity talent pipeline while contributing to a more resilient digital ecosystem.