🔴 Critical: URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
-
The PHP project has disclosed another remote code execution risk just two days after releasing emergency patches for the critical PHP2Shell flaws. The new issue, tracked as CVE-2026-115560, only affects web applications that are configured in an unusual way, and the PHP team assesses it as an unlikely risk.
Because of that limited exposure, PHP is not shipping an emergency fix for CVE-2026-115560. Instead, the project recommends disabling a specific feature as the primary mitigation step. Administrators running PHP in non-standard configurations should review their setups and turn off that feature where it is not required.
Key points:
- A new RCE vector, CVE-2026-115560, follows the emergency PHP2Shell patches by two days.
- Exploitation depends on an unusual web application configuration, so PHP rates the risk as unlikely.
- No emergency patch is planned; the recommended action is to disable the affected feature.
Given that this arrives so soon after the PHP2Shell fixes, teams should confirm which PHP configurations they actually run and apply the recommended setting change rather than waiting for a patch.
Source: The Hacker News
Does your organization rely on the feature PHP is recommending to disable, and if so, how are you handling the trade-off?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login