OffSec Releases Free PHP2Shell Lab After Disclosing Critical Remote‑Code‑Execution Vulnerability in PHP
What Happened — Offensive Security (OffSec) publicly disclosed a critical remote‑code‑execution (RCE) flaw in the PHP runtime (tracked as CVE‑2024‑XXXXX). The vulnerability allows an unauthenticated attacker to upload a malicious “php2shell” payload and execute arbitrary commands on any web server running affected PHP versions (8.2.0‑8.2.12). OffSec released a free, hands‑on lab that reproduces the exploit chain, demonstrates detection techniques, and provides mitigation guidance. The advisory was published on 29 Oct 2026; no active exploitation campaigns have been reported yet, but the risk is deemed high because the flaw is exploitable over the network without credentials.
Why It Matters for Trust & Control Assurance — The issue tests an organization’s vulnerability‑management controls: timely detection, patching, and evidence of remediation are essential to demonstrate a defensible security posture.
Who Is Affected
- Web‑application developers and operators using PHP 8.2.x
- SaaS platforms, cloud‑hosted sites, and on‑premise web servers that expose PHP to the internet
Recommended Actions
- Verify the PHP version in use and compare against the affected range.
- Apply the official PHP security patch (or upgrade to 8.2.13 or later) immediately.
- Deploy runtime application‑layer WAF rules that block the php2shell payload pattern.
- Record patch‑deployment evidence in your control‑mapping repository for audit readiness.
Technical Notes
- Attack vector: Network‑level exploitation of a code‑execution flaw (VULNERABILITY_EXPLOIT).
- CVE: CVE‑2024‑XXXXX (CVSS 9.8 Critical).
- Data at risk: Any data processed by the compromised web application, including user credentials, PII, or proprietary code.
- Discovery: OffSec’s research team identified the flaw during routine source‑code review and released a reproducible lab on 28 Oct 2026.
Source: HackRead article