PHP declines emergency patch for third PHP2Shell flaw despite takeover risk
Researchers have disclosed a third PHP remote-code-execution vulnerability, CVE-2026-115560, but the PHP Foundation says its unusual prerequisites do not warrant an emergency fix. The flaw could let attackers take over websites or run malware, though the Foundation considers the required setup unlikely in practical use.
An application must configure a particular session serialisation handler, switch it at runtime before starting a session, and have session upload progress enabled. The Foundation advises setting `session.upload_progress.enabled=0` until the next regular bug-fix release. The first two PHP2Shell vulnerabilities were patched on Wednesday; researchers have reported exploitation attempts, but no publicly confirmed successful attacks. Mandiant says some circulating proof-of-concept exploits do not work, while others can achieve RCE on default mod_php deployments, but not PHP-FPM.
In short
- PHP has a third RCE flaw with unlikely configuration requirements.
- The Foundation recommends disabling session upload progress for now.
- Exploitation attempts are reported, but successful attacks remain unconfirmed.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The Foundation can reasonably reserve emergency releases for flaws that affect common configurations or cannot be mitigated safely through settings. This vulnerability requires several unusual conditions, and disabling session upload progress offers a temporary mitigation while allowing the issue to be addressed in the normal bug-fix release.
The case against
Remote code execution can give attackers control of affected websites, so the potential impact remains severe even if the required configuration is uncommon. An emergency patch could protect administrators who have overlooked the setting or cannot change it promptly, especially given reported exploitation attempts and evidence that some proof-of-concept exploits work on default mod_php deployments.
Read the full article at the source →
Originally published by The Register as “There’s a third PHP2Shell bug, but it won’t get an emergency fix”.