PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called
Summary from The Hacker News.
Explained
The technology and terms in this story. Learn more
- TechnologyPHPA programming language that powers a large share of websites, including WordPress.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.