Third PHP2Shell vulnerability found, but no emergency fix planned

CVE-2026-115560 requires unlikely configuration, foundation says, while researchers warn threat remains viable

By LineZotpaper AI staff

Published23 October 2026

Read Time2 min

The PHP Foundation has confirmed a third remote code execution vulnerability in the PHP programming language, but says it will not issue an emergency patch because the flaw requires an unlikely combination of configuration and application code. Users are advised to apply a configuration workaround until the next regular bugfix release.

The vulnerability, assigned CVE-2026-115560, joins the two previously disclosed PHP2Shell bugs that prompted widespread concern earlier this week. Unlike those earlier flaws, which received immediate patches, the foundation said this one can be mitigated by a configuration setting and does not pose the same level of risk.

Elizabeth Barron, executive director of the PHP Foundation, told The Register that the issue "requires a very unlikely combination of configuration and specific PHP application code, which we do not expect to occur in practical use of PHP." The foundation has published an informational advisory suggesting administrators "set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector."

The two earlier PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed and patched on Wednesday. They involve memory-safety flaws in PHP, which runs on about 70 percent of websites with a known server-side programming language. Despite multiple proof-of-concept exploits circulating online and reports of mass exploitation attempts, the foundation said it has no evidence of successful compromises on patched systems.

Not all security experts are downplaying the risk. Charles Carmakal, chief technology officer at Mandiant, said in a LinkedIn post that "nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious." He noted that while many publicly circulating PoCs appear to be "vibe-coded" and incapable of remote code execution, some verified PoCs are capable of RCE against default deployments of mod_php, though not against PHP-FPM.

The foundation is working with OpenAI, Wiz and Calif on the issue, and said it will release a full advisory and fixed software with the next regular PHP release.

Analysis

Why This Matters

PHP powers a large share of websites worldwide, making any vulnerability in the language a broad security concern.
The emergence of a third flaw shows that the PHP2Shell saga is not over, and the public debate over the severity of these bugs may shape patching priorities.
The configuration workaround offers immediate protection but requires action by administrators, who may need to evaluate their deployments.

Background

The PHP2Shell vulnerabilities were first reported as a pair of critical memory-safety flaws (CVE-2026-109618 and CVE-2026-109619) that could allow remote code execution. They were disclosed and patched on Wednesday October 21, 2026. The PHP Foundation, Google Cloud's Mandiant and Wiz have been investigating related issues. The third bug (CVE-2026-115560) was discovered during the same investigation but deemed less urgent due to its specific requirements.

Key Perspectives

PHP Foundation: The flaw requires a rare configuration and is unlikely to be exploited in practice. A configuration setting can fully mitigate it until the next regular release. Mandiant's Charles Carmakal: The threat is viable and very serious. Some publicly available proof-of-concept exploits are capable of remote code execution against default mod_php setups.

What to Watch

Whether any successful exploitation of CVE-2026-115560 is confirmed in the coming weeks.
The next regular PHP bugfix release, expected to patch this vulnerability.
Adoption of the recommended mitigation (session.upload_progress.enabled=0) by administrators.

Sources

There's a third PHP2Shell bug, but it won't get an emergency fix · The Register

Checked

12 claims in this story checked against 1 source: 10 supported.

Show each claim

SupportedA third PHP2Shell vulnerability has been found.www.theregister.com - Articles: “researchers have found a third PHP vulnerability that could allow attackers to take over websites or remotely run malware on vulnerable systems.”
SupportedThe third vulnerability will not receive an emergency fix.www.theregister.com - Articles: “There's a third PHP2Shell bug, but it won't get an emergency fix.”
SupportedThe foundation says CVE-2026-115560 requires an unlikely combination of configuration and application code.www.theregister.com - Articles: “CVE-2026-115560 “requires a very unlikely combination of configuration and specific PHP application code, which we do not expect to occur in practical use of PHP,” Elizabeth Barron, executive director of the PHP Foundation, told The Register.”
Partly supportedResearchers warn that the threat remains viable.www.theregister.com - Articles: ““Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious,” Mandiant Chief Technology Officer Charles Carmakal said in a Friday LinkedIn post.”
SupportedThe PHP Foundation confirmed a third RCE vulnerability in PHP.www.theregister.com - Articles: “The PHP Foundation on Friday told The Register that it has reserved a CVE identifier (CVE-2026-115560) for a third RCE flaw to go with the first two that comprise PHP2Shell”
SupportedThe foundation will not issue an emergency patch because the flaw requires an unlikely configuration and application-code combination.www.theregister.com - Articles: “This setup, according to the PHP Foundation, is unlikely in real-world applications, and as such doesn’t pose the same massive risk as the earlier two CVEs”
SupportedThe advisory recommends disabling session upload progress until the next regular bugfix release.www.theregister.com - Articles: “set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector.”
Partly supportedThe two earlier PHP2Shell vulnerabilities received immediate patches.www.theregister.com - Articles: “The PHP Foundation officially disclosed and patched both bugs on Wednesday.”
SupportedPHP runs on about 70 percent of websites with a known server-side programming language.www.theregister.com - Articles: “the open source programming language running on about 70 percent of websites with a known server-side programming language.”
SupportedThe foundation said it had no evidence of successful exploitation on patched PHP versions.www.theregister.com - Articles: ““We have no evidence of successful exploitation of the two vulnerabilities from Wednesday prior to disclosure, and we currently have no evidence of any exploitation of these vulnerabilities on patched PHP versions,” Barron said.”
SupportedCarmakal said exploitation may have begun in a limited fashion and the threat is viable and very serious.www.theregister.com - Articles: ““Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious,” Mandiant Chief Technology Officer Charles Carmakal said in a Friday LinkedIn post.”
SupportedSome validated proof-of-concept exploits can achieve RCE on default mod_php deployments, but not PHP-FPM.www.theregister.com - Articles: “We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.”