PHP Just Flagged Another RCE Risk Days After Its Emergency Fixes

Michael Miller · 2026-10-23

PHP dropped emergency patches for the critical PHP2Shell flaws. Two days later, it's already warning about another way attackers could run code on your server. Here's the twist: this time, PHP isn't rushing to fix it. So what's actually going on? Let's break it down without the panic. ### The New Flaw: CVE-2026-115560 The fresh issue carries the identifier CVE-2026-115560. It lets an attacker potentially execute code on a web server, which is the same scary category as PHP2Shell. But there's a big caveat baked into the details. This one only hits web applications configured in a pretty unusual way. We're not talking about a default setup that millions of sites run out of the box. PHP itself considers the risk unlikely, and that phrasing matters. Think of it like a lock that only fails if you've installed it upside down and left the key in it. Yes, it's a real weakness. No, most people will never encounter it. ### Why PHP Isn't Issuing an Emergency Fix This is the part that raises eyebrows. After shipping urgent patches for PHP2Shell, the project is choosing not to rush a fix for CVE-2026-115560. That decision makes more sense than it first appears: - The flaw depends on an uncommon configuration, so the blast radius is small - Emergency patches carry their own risk of breaking things, and PHP just shipped a big one - The project would rather people remove the risky setup than patch around it In other words, PHP is betting that the smarter move is prevention, not another scramble. ### What PHP Recommends Instead The guidance is refreshingly simple. Rather than wait for a patch, PHP recommends turning off a specific feature tied to the vulnerable configuration. Disabling it removes the exposure entirely. If you run PHP in production, this is your cue to check your setup. Ask yourself a few plain questions: - Does our configuration rely on that feature? - Who set it up, and do we actually need it? - Can we turn it off without breaking anything? If the answer to the last one is yes, you've just closed the door on this CVE without waiting for a fix. ### The Bigger Lesson From a Busy Week Two remote code execution warnings in two days is a lot for one project. But the story here isn't really about panic. It's about how security teams should read these alerts. > "Not every CVE is a five-alarm fire. The severity score tells you how bad it could be. The configuration tells you how likely it is to reach you." That distinction is everything. A critical flaw that requires an exotic setup is very different from one that hits default installs. Treating them the same wastes time and burns out your team. ### What You Should Do Right Now Here's the short version: - Confirm you've applied the PHP2Shell emergency patches - Audit your PHP config for the feature PHP is telling you to disable - Turn it off if you don't need it - Keep watching for updates, because this story may not be over Stay calm, stay patched, and read the config notes before you panic. That's the whole game.