There's a third PHP2Shell bug, but it won't get an emergency fix
A third PHP vulnerability (CVE-2026-115560) has been identified as part of the PHP2Shell collection of RCE flaws. The PHP Foundation decided against an emergency patch because the flaw requires an improbable combination of specific configuration settings and application code patterns rarely seen in production environments. The vulnerability can be mitigated through configuration changes until the next regular PHP release.
Key points
- Third PHP2Shell RCE vulnerability identified (CVE-2026-115560)
- No emergency fix planned due to unlikely real-world occurrence
- Mitigation available through configuration setting adjustment
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.
Read the full story at The Register
