# PHP declines emergency patch for third PHP2Shell flaw despite takeover risk

- URL: https://talkfuse.com/story/theres-a-third-php2shell-bug-but-it-wont-get-an-emergency-fix/
- Published: 2026-10-23T20:04:40+00:00
- Updated: 2026-10-23T22:08:18+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/10/23/theres-a-third-php2shell-bug-but-it-wont-get-an-emergency-fix/5305208
- Topics: Software, Technology

## Key points

- PHP has a third RCE flaw with unlikely configuration requirements.
- The Foundation recommends disabling session upload progress for now.
- Exploitation attempts are reported, but successful attacks remain unconfirmed.

## Summary

Researchers have disclosed a third PHP remote-code-execution vulnerability, CVE-2026-115560, but the PHP Foundation says its unusual prerequisites do not warrant an emergency fix. The flaw could let attackers take over websites or run malware, though the Foundation considers the required setup unlikely in practical use.

An application must configure a particular session serialisation handler, switch it at runtime before starting a session, and have session upload progress enabled. The Foundation advises setting `session.upload_progress.enabled=0` until the next regular bug-fix release. The first two PHP2Shell vulnerabilities were patched on Wednesday; researchers have reported exploitation attempts, but no publicly confirmed successful attacks. Mandiant says some circulating proof-of-concept exploits do not work, while others can achieve RCE on default mod_php deployments, but not PHP-FPM.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.