PHP Warns of New Unpatched RCE Flaw Just Days After Critical Fixes
A newly disclosed RCE vulnerability in PHP affects servers with uncommon configurations. No patch yet, but mitigation steps are available.
TL;DR
- PHP disclosed CVE-2026-115560, a new remote code execution flaw.
- The vulnerability impacts only unusually configured web apps.
- No emergency patch planned; admins should disable certain features.
- This follows closely after the critical PHP2Shell patches.
- Organizations using PHP should review their configurations immediately.
Just two days after releasing emergency fixes for the critical PHP2Shell vulnerabilities, the PHP project has warned of a new unpatched remote code execution (RCE) flaw. This latest issue, tracked as CVE-2026-115560, poses a risk primarily to web applications running in non-standard configurations.
While the PHP team does not consider this a likely attack vector and has opted not to release an emergency update, they have provided clear guidance for mitigating the threat. Server administrators are advised to disable specific features that could be exploited until further notice.
Understanding CVE-2026-115560
- CVE-2026-115560 allows potential remote code execution on affected servers.
- It targets PHP installations with rare configuration setups.
- Unlike PHP2Shell, this flaw doesn't warrant an immediate patch release.
- Attackers would require knowledge of specific server configurations to exploit it.
Recommended Mitigation Steps
- Disable the vulnerable PHP feature as outlined in the official advisory.
- Audit existing PHP configurations for non-standard settings.
- Monitor systems for unusual activity that could indicate exploitation attempts.
- Stay tuned for future updates from the PHP development team.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.