OffSec Launches Free PHP2Shell Lab Following Critical Vulnerability Discovery
New York, United States, 28th October 2026, CyberNewswire Press ReleaseThis is a press release. It was supplied by a third party and was not written by the TechBullion editorial team. New York, United States, October 28th, 2026, CyberNewswire The two critical flaws sat inside PHP, the language behind roughly 70% of websites whose server-side language is known, for more than a decade. Then researchers at Wiz, a Google-owned cloud security company, pointed AI at the code. They found the first flaw Aug. 19. The next day they used it to take over a Drupal site without a password. The day after that, it worked on WordPress. PHP disclosed the flaws Oct. 21 as CVE-2026-109618 and CVE-2026-109619. An attacker with no login can send a series of crafted web requests to crash a server or take it over. PHP’s severity scores rate both vulnerabilities as complex to exploit, even though working…