PHP has disclosed a new unpatched RCE vulnerability (CVE-2026-115560) just two days after patching PHP2Shell. Here's what you need to know and do.
Just when you thought it was safe to relax, PHP has dropped another security bombshell. Only two days after releasing emergency patches for the critical PHP2Shell vulnerabilities, the PHP team is warning about yet another way attackers could execute code on your web server. This new flaw, tracked as CVE-2026-115560, is a bit different from the usual scare tactics, though.
### The Lowdown on CVE-2026-115560
First things first: this isn't a repeat of PHP2Shell. The new vulnerability only affects web applications that are configured in a very specific, and frankly unusual, way. According to PHP, the risk is low, and they're not planning to rush out an emergency fix. Instead, they're recommending that you disable a particular feature. (They didn't specify which feature in the initial advisory, but we'll update as soon as we know more.)
So, what does this mean for you? If you're running a standard PHP setup, you can probably breathe easy. But if you've tweaked your configuration in ways that are off the beaten path, it's worth double-checking. The last thing you want is to be the exception to the rule.
### Why This Matters Even If You're Not Affected
The PHP2Shell patches were a big deal because they addressed a remote code execution (RCE) flaw that could be exploited by anyone with a browser. This new issue, while less severe, is a reminder that security is a moving target. Attackers are always looking for that one weird configuration that opens a door. And PHP, like any widely-used language, is a prime target.
> "Security is a process, not a product." – Bruce Schneier
That quote feels especially relevant here. The PHP team is being transparent about the risk and not overreacting, which is a good sign. But it's up to you to stay informed and act accordingly.
### What Should You Do Right Now?
- **Check your PHP configuration**: Are you using any non-standard features or settings? If so, review them. The PHP advisory might not name the feature, but you can bet it'll be in the docs soon.
- **Stay updated**: Follow the official PHP security mailing list or watch their announcements. They're the first to know.
- **Don't panic**: This isn't a sky-is-falling moment. It's a "stay vigilant" moment.
- **Review your logs**: If you're paranoid (and in security, a little paranoia is healthy), look for any unusual activity that might indicate an attempted exploit.
### The Bigger Picture
PHP powers a huge chunk of the web, from WordPress to Wikipedia. That makes it a constant target. The PHP2Shell flaws were a wake-up call, and this new issue is a follow-up reminder. The project's decision not to issue an emergency patch is a calculated one—they're weighing the risk against the disruption of another rushed update. It's a judgment call, and only time will tell if it's the right one.
In the meantime, keep your systems patched, your configurations lean, and your ear to the ground. Security never sleeps, and neither should your vigilance.
We'll keep you posted as more details emerge about CVE-2026-115560 and the recommended workarounds. Stay safe out there.
