OffSec has added a free PHP2Shell practice lab to Proving Grounds Play, alongside more than 40 hands-on challenges in its latest weekly release. The October 23 announcement gives learners a controlled environment for exploring CVE-2026-109618.
What You Can Access for Free
The official release links directly to the new PHP2Shell lab. Although the announcement discusses two PHP vulnerabilities, its specific free-lab description identifies CVE-2026-109618.
OffSec’s Proving Grounds rules say Play is free for registered users, with three hours of access over a 24-hour window. Learners receive private machines and can run one at a time. Plan your session around that limit; reaching it closes the running machine.
More Labs for Subscribers and Teams
The wider release includes web application, software delivery and Active Directory exercises, plus investigations involving identity systems, invoice fraud and other simulated incidents. These additions have different access requirements.
Annual Membership Program users receive a rotating selection of challenges. The release’s team lab collection requires a Learn Enterprise license, so the full weekly collection should not be treated as a free offering.
Who This Is For
The free lab may interest learners who want practical web security experience. The broader investigations may also interest:
- Application Security Engineers developing their understanding of application weaknesses.
- Incident Responders practicing how to interpret evidence and reconstruct an incident.
These are suggested learning connections, rather than enrollment requirements.
How to Get Started
New users can follow OffSec’s free-account registration instructions: choose Proving Grounds Play on its individual labs page, create an account, then open Play from the platform’s Labs area. Use the lab link in the weekly announcement to locate this particular exercise, and check the access requirements before choosing additional challenges.
