‘PHP2Shell’ - New Challenge on SkillBit Labs
Every security team read about php2shell this week, but not everyone knows if they can contain it on a server that can't be patched yet.
php2shell is two critical RCE flaws in PHP, CVE-2026-109618 and CVE-2026-109619, that let an unauthenticated attacker run code on the server. Our challenge covers half of that, focusing on CVE-2026-109618. For teams that can't upgrade yet, the advisory offers an interim config change and admits it's incomplete.
Upgrading is the easy part. The hard part is the hours before the maintenance window, when someone has to apply an incomplete interim fix and keep the business running. Our new challenge on SkillBit Labs targets skills needed for this exact moment.
The challenge on SkillBit Labs: ‘PHP2Shell’
You're the admin for a small business website that still runs PHP 8.5.11 under Apache with mod_php. The upgrade has to wait, so your job is to apply the interim fix, restart Apache, and keep customer artwork uploads working.
What it actually tests
- Finding the right config. The CLI says no php.ini is loaded. True, and irrelevant: Apache reads its own.
- Reading the advisory, not the file. The php.ini is about 1,880 lines of defaults. The advisory tells you what to change.
- Changing only what you meant to. The restart script rejects any other directive change, so "harden everything while I'm in here" won't pass.
- Not breaking the business. Uploads must still return the correct checksum, and nothing counts until Apache restarts.
‘PHP2Shell’ is live now on SkillBit Labs at https://app.skillbit.com/challenges/32840.
