Update: A Third PHP2Shell Bug (CVE-2026-115560), but No Emergency Fix

Update to my PHP2Shell post and my PHP patching how-to. Researchers found a third PHP remote code execution flaw, but this one isn’t getting an emergency release, The Register reports.

What’s new

• The PHP Foundation reserved CVE-2026-115560. A full advisory and fix will come with the next regular PHP release.
• Executive director Elizabeth Barron says it “requires a very unlikely combination of configuration and specific PHP application code,” and “can be mitigated with a configuration setting.”
• The vulnerable setup: an app sets session.serialize_handler to php_binary or php_serialize, then switches it to php at runtime with ini_set() before session_start(), with session upload progress turned on.
• PHP’s informational advisory says to set session.upload_progress.enabled=0 until the next bugfix release.
• On the original two bugs (CVE-2026-109618 and CVE-2026-109619), the Foundation says it has no evidence of exploitation on patched PHP versions. Mandiant’s CTO says many public PoCs look “vibe-coded” and don’t work, but some do achieve RCE against default mod_php setups (not PHP-FPM).

My take

Not a panic, but an easy win. If you’re already patched for the first two bugs, setting session.upload_progress.enabled=0 costs most sites nothing. Then grab the regular release when it ships. I put together a generic checklist for this here.

Have a blessed day! And Happy Hacking!

References & Further Reading

• There’s a third PHP2Shell bug, but it won’t get an emergency fix (The Register)
• Original post: PHP2Shell: Two Critical PHP Flaws Allow Remote Code Execution (EtherNinja)
• How-To: Patch PHP on a WordPress Server for PHP2Shell (EtherNinja)