<![CDATA[🔴 Critical: URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches]]>The PHP project has disclosed another remote code execution risk just two days after releasing emergency patches for the critical PHP2Shell flaws. The new issue, tracked as CVE-2026-115560, only affects web applications that are configured in an unusual way, and the PHP team assesses it as an unlikely risk.

Because of that limited exposure, PHP is not shipping an emergency fix for CVE-2026-115560. Instead, the project recommends disabling a specific feature as the primary mitigation step. Administrators running PHP in non-standard configurations should review their setups and turn off that feature where it is not required.

Key points:

  • A new RCE vector, CVE-2026-115560, follows the emergency PHP2Shell patches by two days.
  • Exploitation depends on an unusual web application configuration, so PHP rates the risk as unlikely.
  • No emergency patch is planned; the recommended action is to disable the affected feature.

Given that this arrives so soon after the PHP2Shell fixes, teams should confirm which PHP configurations they actually run and apply the recommended setting change rather than waiting for a patch.

Source: The Hacker News

Does your organization rely on the feature PHP is recommending to disable, and if so, how are you handling the trade-off?

]]>https://xploitlk.com/topic/763/critical-urgent-php-warns-of-another-unpatched-rce-two-days-after-emergency-php2shell-patchesRSS for NodeTue, 27 Oct 2026 07:48:41 GMTFri, 23 Oct 2026 12:30:20 GMT60