There's a third PHP2Shell bug, but it won't get an emergency fix

A third remote code execution vulnerability in PHP (CVE-2026-115560) was discovered alongside two already-exploited bugs, exposing how dangerous default or permissive PHP configuration settings can be when combined with vulnerable application code. While the PHP Foundation declined an emergency patch due to the specific conditions required to trigger this flaw, the broader PHP2Shell situation demonstrates that mass exploitation attempts begin rapidly after disclosure. Organizations relying solely on vendor patch timelines without applying interim mitigations — such as disabling session.upload_progress — remain exposed during the window between disclosure and a regular release. This incident reinforces that secure configuration management is a critical complement to patching, not a substitute for it.