PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called
What happened
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called
Why it matters
The development may change operating conditions or market expectations around Security. Further confirmation and measurable outcomes matter.
Affected entities
View evidence
1 reports · 1 original report · 1 independent
- The Hacker NewsPrimary source · Supports · EN · 100%PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches ↗
Claims
- PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches Observed
Conflicts
No material conflict detected in the available evidence.
Timeline
- First reported
- Unverified · 57/65%
- Unverified · 56/65%
Market move following event
Market reaction is not yet available for this asset and time window.