ChordNews
← All news

PHP warns of another unpatched remote code execution flaw, CVE-2026-115560, two days after PHP2Shell patches

By ChordNews · First written (updated )

PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
Image: thehackernews.com
Comments 0

Summary

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature, as reported by The Hacker News.

This continues an earlier story: PHP ships emergency patches for two critical PHP2Shell remote code execution flaws

Timeline

  1. The Hacker News

    Source ↗

    The Hacker News reports that PHP warned of another unpatched remote code execution flaw, CVE-2026-115560, two days after shipping emergency fixes for the critical PHP2Shell flaws.

Comments

No comments yet.

    to like and comment.

    © 2026 ChordNews