Thursday, 29 October 2026

Updated 9m agoSaved

Next edition

10:12

Headlines

Top StoriesPersonal data of 40,000 U.S. Homeland Security employees leaked in security breach
Threat IntelligenceYet Another ClickFix Campaign, (Wed, Oct 28th)
Data BreachesPersonal data of 40,000 U.S. Homeland Security employees leaked in security breach
Bugs and PatchesStudying Fraudulent North Korean IT Workers
Cybercrime and ScamsLouisiana Ranks Last for Scam Exposure, Though Complaints Jumped 34%
Nation State HackingPoliticians in U.S. and E.U. Say Targeted Ads Are a Security Risk
Enterprise SecurityThe 4 biggest Amazon smart home announcements from today
Privacy and ComplianceGDPR checklist items data managers might have overlooked
Consumer AdviceAMERICAN WATER REPORTS SOLID THIRD QUARTER 2026 RESULTS; NARROWS 2026 EPS GUIDANCE TO TOP HALF OF RANGE; AFFIRMS LONG-TERM TARGETS; INITIATES STANDALONE 2027 EPS GUIDANCE, REFLECTING GROWTH OF 8%
Incident ResponseUnwrapping Retail Peak Season Cyber Threats

Top StoriesPersonal data of 40,000 U.S. Homeland Security employees leaked in security breach
Threat IntelligenceYet Another ClickFix Campaign, (Wed, Oct 28th)
Data BreachesPersonal data of 40,000 U.S. Homeland Security employees leaked in security breach
Bugs and PatchesStudying Fraudulent North Korean IT Workers
Cybercrime and ScamsLouisiana Ranks Last for Scam Exposure, Though Complaints Jumped 34%
Nation State HackingPoliticians in U.S. and E.U. Say Targeted Ads Are a Security Risk
Enterprise SecurityThe 4 biggest Amazon smart home announcements from today
Privacy and ComplianceGDPR checklist items data managers might have overlooked
Consumer AdviceAMERICAN WATER REPORTS SOLID THIRD QUARTER 2026 RESULTS; NARROWS 2026 EPS GUIDANCE TO TOP HALF OF RANGE; AFFIRMS LONG-TERM TARGETS; INITIATES STANDALONE 2027 EPS GUIDANCE, REFLECTING GROWTH OF 8%
Incident ResponseUnwrapping Retail Peak Season Cyber Threats

OffSec launches free lab to test PHP2Shell remote code execution flaws

OffSec has released a free training environment in Proving Grounds Play to help defenders examine and mitigate two critical PHP vulnerabilities.

FTMQ Security, written by our newsroom29 October 2026 at 00:200 views

Share

OffSec released a free interactive lab in Proving Grounds Play on October 28, 2026, allowing security professionals to examine and defend against two critical vulnerabilities known as PHP2Shell. CyberSecurityNews reported that the hands-on lab covers the flaws designated as CVE-2026-109618 and CVE-2026-109619. [1]

The PHP2Shell flaws are memory safety vulnerabilities affecting PHP versions 5.4 through 8.5. According to Wikipedia, the security issues allow attackers to achieve remote code execution and gain remote control of website hosts. [3]

Researchers discovered the vulnerabilities with the assistance of artificial intelligence in August 2026, and details were publicly announced on October 20, 2026. Wikipedia states that the flaws were estimated to impact nearly 70 percent of websites, prompting emergency patches for PHP versions 8.2, 8.3, 8.4, and 8.5 the following day. [3]

As FTMQ Security reported earlier, critical remote code execution flaws frequently lead to rapid exploitation after public disclosure. CyberSecurityNews noted that OffSec designed the new lab environment specifically to give security teams practical exposure to these issues as AI-assisted research changes vulnerability discovery. [1][4]

Share

In short

OffSec launched a free lab in Proving Grounds Play to test PHP2Shell vulnerabilities.
PHP2Shell consists of CVE-2026-109618 and CVE-2026-109619, affecting PHP versions 5.4 through 8.5.
The vulnerabilities allow remote code execution and were estimated to affect nearly 70 percent of websites.
Emergency patches were released for PHP versions 8.2, 8.3, 8.4, and 8.5 on October 21, 2026.

Sources

Every paragraph above points to the numbered items it rests on. Read the originals here.

[1]OffSec Launches Free PHP2Shell Lab Following Critical Vulnerability DiscoveryCyberSecurityNews, 7h ago (the report this story comes from)

Background

[2]List of security hacking incidents on Wikipedia
[3]PHP2Shell on Wikipedia
[4]Hackers target Rejetto HFS servers following critical session forgery vulnerability discovery FTMQ Security, 23d ago

Our newsroom writes these reports with the help of software, from the 4 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.

Earlier reports of ours on the same people and subjects.

University of Copenhagen data breach exposes personal data of 525000 peopleTop Stories, 2d ago
Anthropic launches free artificial intelligence security scanning service for open source maintainersCybercrime and Scams, 18d ago
US Agencies Release Guidelines for Super Intelligence Control IncidentsThreat Intelligence, 12d ago

More in Top Stories

Get the day in one email

Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.

By signing up you agree to our terms and privacy policy. Unsubscribe any time.

Comments

Loading

Join the conversation

Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.

Already on the list? Enter the same address and we will send a sign-in link.

By signing up you agree to our terms and privacy policy. Unsubscribe any time.