CRITICALVulnerability
Global

PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

·Source: The Hacker News

Updated:

Executive Summary

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called

Analysis

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called

Indicators of Compromise (1)

CVE (1)
CVE-2026-115560
NVDMITRE CVE
Source Attribution

Originally published by The Hacker News on Oct 23, 2026.

Related Threats

CRITICALVulnerability

PHP Publishes Mitigation Advice for New RCE Flaw

PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected

CVE-2026-115560
Infosecurity Magazine
CRITICALVulnerability

PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): [Updated for CVE-2026-115560]

Two critical flaws in PHP’s request lifecycle can enable unauthenticated remote code execution. Upgrade to a fixed release or install a vendor backport for older versions.

CVE-2026-109618CVE-2026-109619
Snyk
CRITICALVulnerability

URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called

CVE-2026-115560
The Hacker News