PHP2Shell flaws exploited in the wild; OffSec ships free lab
Original title: OffSec Launches Free PHP2Shell Lab Following Critical Vulnerability Discovery
CISA listed both flaws on October 26; fixed PHP builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
OffSec released a free Proving Grounds Play lab and an Exploit-DB proof of concept for PHP2Shell, CVE-2026-109618 and CVE-2026-109619, memory-corruption bugs Wiz found in PHP in August using AI-assisted review. Unauthenticated crafted requests can crash a server or run code as the web server user, and Wiz says process memory may leak secrets. PHP disclosed the flaws on October 21 with a 9.2 score; Amazon calls them broadly exploited, honeypots showed command execution by October 24, and CISA added both to KEV on October 26. A separate issue, CVE-2026-115560, disclosed October 23, still has no fix.
Unconfirmed: Amazon’s claim of broad exploitation is the company’s characterization; PHP still rates both flaws complex to exploit.
- Wiz found the first flaw on August 19 and the next day took over a Drupal site without a password.
- The following day the same issue worked against WordPress, according to the report.
- Disable session.upload_progress.enabled to reduce exposure, including for CVE-2026-115560.
- Review logs back to at least October 17 and rotate potentially exposed credentials and tokens.
- Updating WordPress or Drupal does not patch the PHP engine itself.
Impact: Unauthenticated code execution or crash, plus possible memory leaks
| Product | Affected | Fixed in |
|---|---|---|
| PHP | — | 8.5.12, 8.4.27, 8.3.36, or 8.2.35 |
- 1.Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart workers.
- 2.Set session.upload_progress.enabled=0 while patching; on PHP 8.5 also disable fatal-error backtraces.
- 3.Hunt for suspicious multipart requests and HTTP 500s since October 17, then rotate secrets.
- Vendors
- PHP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-115560 | — | — | PoC ×11 | — |
From the original article
4 min read at gbhackers.comNew York, United States, October 28th, 2026, CyberNewswire New hands-on lab lets security practitioners explore PHP2Shell exploitation firsthand as AI-assisted research reshapes vulnerability discovery.
By CyberNewswire · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.