Introduction: OffSec has officially celebrated its 20th anniversary by dropping a significant milestone discount on its signature Learn One annual subscription. As cyber threats mature beyond traditional network boundaries, practical, hands-on certifications like PEN-200 (OSCP), EXP-301 (OSCE+), WEB-300 (OSWE), and the AI-300 (OSAI+) advanced AI red teaming track have become key benchmarks for offensive security teams. This milestone highlights the industry shift toward practical lab validation over static theoretical testing, emphasizing real-world adversary emulation across corporate infrastructures, custom exploit binaries, web endpoints, and autonomous artificial intelligence deployments.

The Chaos Foundry Nexus - OffSec, Research, Indie Games, mild villainy, and vibes. Join The Nexus today!

New York, United States, October 28th, 2026, CyberNewswire New hands-on lab lets security practitioners explore PHP2Shell exploitation firsthand as AI-assisted research reshapes vulnerability discovery. OffSec today announced the release of a free, interactive hands-on lab in Proving Grounds Play (PG Play) to help security practitioners examine and defend against the critical “PHP2Shell” vulnerabilities (CVE-2026-109618 and […]

Security research is one of the areas where open source has had the deepest and most complex impact. Tools built openly are used to defend critical

New York, United States, 28th October 2026, CyberNewswire

New York, United States, 28th October 2026, CyberNewswire

New hands-on lab lets security practitioners explore PHP2Shell exploitation firsthand as AI-assisted research reshapes vulnerability discovery.

New hands-on lab lets security practitioners explore PHP2Shell exploitation firsthand as AI-assisted research reshapes vulnerability discovery.

New hands-on lab lets security practitioners explore PHP2Shell exploitation firsthand as AI-assisted research reshapes vulnerability discovery.

Introduction: The rapid adoption of Large Language Models (LLMs) and AI agents in cyber-offense and bug bounty automation creates a critical authorization gap. When security beginners or automated scripts ask AI models to drive vulnerability scanners like OWASP ZAP, Nmap, or Metasploit, models often generate raw attack vectors without evaluating scope, permissions, or targets. While possessing security tooling is entirely legal, executing unvalidated network actions across non-consensual targets transforms a learning session into illegal computer intrusion under federal laws like the CFAA.

New York, United States, 28th October 2026, CyberNewswire

New York, United States, October 28th, 2026, CyberNewswire New hands-on lab lets security practitioners explore PHP2Shell exploitation firsthand as AI-assisted research reshapes vulnerability discovery. OffSec today announced the release of a free, interactive hands-on lab in Proving Grounds Play (PG Play) to help security practitioners examine and defend against the critical “PHP2Shell” vulnerabilities (CVE-2026-109618 and […]

**New hands-on lab lets security practitioners explore PHP2Shell exploitation firsthand as AI-assisted research reshapes vulnerability discovery.** OffSec today announced the release of a free, interactive hands-on lab in Proving Grounds Play (PG Play) to help security practitioners examine and defend against the critical “PHP2Shell” vulnerabilities (CVE-2026-109618 and CVE-2026-109619) firsthand. Developed in response to AI-accelerated vulnerability discovery and active exploits targeting core PHP engines in the wild, the lab provides penetration testers and enterprise defenders with a safe, controlled environment to study the decade-old memory corruption flaws and implement timely server mitigations. The two critical flaws sat inside PHP, the language behind roughly 70% of websites whose server-side language is known, for more than a decade. Then researchers at Wiz, a Google-owned cloud security company, pointed AI at the code. They found the first flaw Aug. 19. The next day they used it to take over a Drupal site without a password. The day after that, it worked on WordPress. PHP disclosed the flaws Oct. 21 as CVE-2026-109618 and CVE-2026-109619. An attacker with no login can send a series of crafted web requests to crash a server or take it over. PHP’s severity scores rate both vulnerabilities as complex to exploit, even though working attacks already existed. The Cybersecurity and Infrastructure Security Agency (CISA) recommends patching immediately. Attackers are moving fast. Amazon calls PHP2Shell broadly exploited in the wild. By Oct.24, researchers had confirmed attackers running commands on vulnerable honeypot servers. **CISA added both flaws to its Known Exploited Vulnerabilities catalog on Oct. 26.** “PHP is one of those technologies attackers love to see,” **said Keegan Bowen, principal DevOps lead at OffSec**. “It has been a great attack vector over the years with many exploits and potential abuses. PHP wasn’t designed with security from the start.” OffSec, which has taught hands-on offensive security since 2006, has released a free PHP2Shell lab in Proving Grounds Play (PG Play). The lab gives penetration testers and other security professionals a controlled environment to explore CVE-2026-109618 and CVE-2026-109619 firsthand. OffSec’s blog breaks down both flaws, and its proof-of-concept exploit is available on Exploit-DB. **AI and the Evolving Pace of Exploitation** PHP scored both flaws 9.2 out of 10, a critical rating. To build a working attack, Wiz researchers had to chain several bugs together and tune the attack to each server’s memory. When they let AI do the grind, one researcher finished in a week what once took a top team month. Attackers can use the same AI models, so flaws once ranked too complex to matter are now fair game. “At this point, attackers are heavily leaning on AI to find and exploit vulnerabilities; the rate of CVEs is roughly double what was reported last year,” **said Matt Freitas-Stavola, staff software engineer at OffSec.** “LLMs don’t get tired and can easily run in the background for as long as attackers have money or compute to spare. Even now, just a hint of where an issue could arise is enough for an LLM to get a workable POC out relatively quickly.” **The Effects of These Flaws** Both flaws start with the same weak spot: what PHP does when a request runs out of memory or hits another fatal error. “PHP is built from C and memory management becomes increasingly challenging as the code grows,” **Bowen said.** “Some out-of-memory states were not handled well. In some cases, attackers can access interrupted state data before it is cleaned up. That becomes an opportunity for abuse.” That leftover state can carry into the next request on the same worker. An attacker who shapes it can run code with the web server’s privileges. The same bugs can also leak data. Wiz showed attackers could potentially read memory from the PHP process. That memory could hold passwords, session tokens, API keys, and certificates from other requests or the server itself. The story is still developing. On Oct. 23, PHP disclosed a separate flaw, CVE-2026-115560, that can affect fully patched servers with an unusual session setup. PHP has no fix for it yet. Researchers have also built PHP2Shell exploits that get past ASLR, a common memory defense, and more issues could surface as the flaws are studied. As research continues, new vulnerabilities, exploitation techniques, and mitigations may emerge beyond those covered here. **OffSec’s Current Recommendations** These steps reflect what is known at the time of publication. Check CISA and the PHP project for the latest recommendations. * **Patch PHP Now.** Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to address CVE-2026-109618 and CVE-2026-109619. Check vendor advisories rather than relying on version numbers alone. * **Update the Underlying PHP Engine.** Updating WordPress, Drupal, or another application does not resolve vulnerabilities in PHP itself. Rebuild affected container images, and restart PHP processes so the updated code takes effect. * **Apply Temporary Protections While Patching.** Disable PHP session upload progress (session.upload_progress.enabled=0), which also mitigates CVE-2026-115560. On PHP 8.5, disable fatal error backtraces and restart affected workers after configuration changes. These measures reduce exposure; they do not replace patching. * **Investigate Potential Compromise.** Review web server and PHP logs for suspicious multipart requests, memory-limit errors, repeated HTTP 500 responses, malformed session cookies, and unexpected PHP worker restarts. Investigations should consider activity dating back to at least October 17, when exploitation attempts were first reported. Rotate potentially affected credentials, API keys, and tokens as appropriate. **Understand the Exploit. Strengthen the Defense.** When the next disclosure lands, someone on the team needs to judge exposure. Reading about an exploit builds awareness. Working on one hands-on builds the skill to respond. OffSec’s PHP2Shell lab helps practitioners turn technical knowledge into hands-on experience they can apply to future vulnerabilities. For a deeper look at the vulnerabilities, explore OffSec’s technical analysis. Organizations looking to build these capabilities across their security teams can explore OffSec’s workforce development programs. **About OffSec** OffSec is the world’s leading provider of high-fidelity cybersecurity training and certifications. Built on a foundation of excellence, integrity, and the relentless “Try Harder” ethos, OffSec empowers individuals and organizations to outsmart evolving cyber threats through rigorous, hands-on learning. ##### **Contact** **Press Team** **OffSec** **Kathryn@kbmediaconsulting.com**

The post shares a free manual and course series titled 'The Book of Kali,' focusing on foundational wireless attacks against WEP, WPS, and WPA2 protocols. It includes a Medium article and a downloadable .pdf, covering tools like Aircrack-ng, Reaver, and Nmap, along with penetration testing techniques. The series is designed for beginners and serves as a reference for the OffSec OSWP certification. The author, a TryHackMe user with an 850+ day streak, has released three parts so far, with an advanced wireless attacks course upcoming.

Introduction: Kali Linux remains the definitive Debian-based operating system built by OffSec for advanced penetration testing, vulnerability assessment, and digital forensics. However, mastering cybersecurity tooling is only half the battle; true operational success requires a disciplined, authorized workflow rooted in industry standards such as the Penetration Testing Execution Standard (PTES) and NIST SP 800-115. This article breaks down a structured methodology that bridges the gap between offensive probing and defensive hardening.