Introduction

OffSec has unveiled a free, interactive lab in Proving Grounds Play (PG Play) designed to help security practitioners understand and defend against two critical PHP vulnerabilities discovered late last year. The PHP2Shell lab gives penetration testers and defenders a safe environment to explore the memory corruption flaws that have been actively exploited across the web.

What Happened

Researchers at Wiz, using AI-accelerated analysis, uncovered two decade-old memory corruption flaws in PHP's core engine. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated attackers to crash servers or gain full control via crafted web requests. Exploits were demonstrated against Drupal and WordPress within days of discovery, and CISA added both to its Known Exploited Vulnerabilities catalog by October 26.

Why This Matters

PHP powers roughly 70% of websites with a known server-side language, making these flaws a widespread risk. The speed of AI-driven discovery and the existence of working exploits mean vulnerabilities once considered too complex to matter are now fair game for attackers. Beyond immediate patching, the case highlights how AI is reshaping the vulnerability landscape, accelerating the pace from months to weeks, and urging organizations to reevaluate their exposure management strategies.

Key Takeaways

  • Update PHP to version 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to address the flaws
  • Rebuild container images and restart PHP processes after updating the underlying engine
  • Disable PHP session upload progress as a temporary mitigation measure
  • Review server and PHP logs for suspicious multipart requests, repeated 500 errors, and unexpected worker restarts
  • Rotate affected credentials, API keys, and tokens, especially if logs show activity since mid-October
  • OffSec's free PHP2Shell lab provides hands-on practice for security teams to build practical defense skills

Conclusion

The rapid discovery and active exploitation of CVE-2026-109618 and CVE-2026-109619 underscore how quickly AI-accelerated research can turn latent flaws into urgent threats. OffSec's new PHP2Shell lab offers a practical pathway for security professionals to gain hands-on experience, strengthen their defense posture, and stay ahead of emerging exploits. Organizations should prioritize patching, audit their logging and credential rotation practices, and treat this incident as a reminder that the speed of vulnerability response must keep pace with AI-driven discovery.