OffSec Introduces PHP2Shell Lab Amid Security Concerns

OffSec has rolled out a new lab within its Proving Grounds Play (PG Play) platform, enabling security professionals to investigate the PHP2Shell vulnerabilities firsthand. This release comes in the wake of AI-driven discoveries and ongoing exploits affecting core PHP systems, providing a valuable resource for penetration testers and enterprise defenders to explore these critical issues in a safe environment.

Understanding the PHP2Shell Threats

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been present in PHP, the server-side language powering approximately 70% of websites, for over a decade. Researchers at Wiz, a cloud security firm under Google’s umbrella, leveraged AI to unearth these flaws. On August 19, they uncovered the first vulnerability, which was quickly exploited on platforms like Drupal and WordPress.

PHP publicly disclosed the vulnerabilities on October 21, highlighting their potential to crash or commandeer servers through crafted web requests. Despite being complex to exploit, both vulnerabilities are actively targeted, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to urge immediate patching.

AI’s Role in Modern Exploitation

PHP assigned a critical 9.2 out of 10 severity score to these vulnerabilities. AI has significantly accelerated the discovery and exploitation process, enabling researchers to achieve in days what previously took months. This shift suggests that vulnerabilities once deemed too intricate are now within reach for attackers equipped with AI tools.

According to OffSec’s Matt Freitas-Stavola, the use of AI in vulnerability exploitation is rapidly increasing, with the number of reported CVEs doubling from the previous year. This evolution underscores the need for continuous vigilance and adaptation in cybersecurity strategies.

Implications and Recommendations

The identified vulnerabilities stem from PHP’s handling of memory and error states, allowing attackers to execute code with server privileges or access sensitive data. Researchers have demonstrated potential data leaks involving passwords and API keys, raising significant security concerns.

Organizations are advised to patch PHP to the latest versions, update underlying engines, and apply temporary protections while investigating potential compromises. OffSec’s PHP2Shell lab offers a practical environment for security teams to enhance their understanding and readiness against such threats.

OffSec remains at the forefront of cybersecurity training, offering comprehensive resources and programs to help organizations bolster their defense mechanisms. For further insights, OffSec’s technical analysis and workforce development opportunities are recommended.