[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8H7GcI76xTvBg9PmPXHZLEMvhUn6bex-m3KM8MAL8yg":3},{"article":4,"iocs":53,"watch_terms":64,"solutions":65,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"c1dbd6dd-3261-49b9-b6d2-f29751094969","There's a third PHP2Shell bug, but it won't get an emergency fix","there-s-a-third-php2shell-bug-but-it-won-t-get-an-emergency-fix-77a47a","Bad things (and software bugs?) come in threes","Researchers discovered a third remote code execution vulnerability (CVE-2026-115560) related to the PHP2Shell chaos, but the PHP Foundation will not issue an emergency patch because it requires an unlikely combination of configuration settings and specific application code. The vulnerability can be mitigated by disabling session.upload_progress, and a fix will ship with the next regular PHP release. Despite mass exploitation attempts against the first two PHP2Shell CVEs (CVE-2026-109618 and CVE-2026-109619), there is no evidence of successful compromises on patched systems.","PHP Foundation reserves CVE for third RCE flaw but declines emergency fix due to unlikely real-world impact.","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F10\u002F23\u002Ftheres-a-third-php2shell-bug-but-it-wont-get-an-emergency-fix\u002F5305208","https:\u002F\u002Fimage.theregister.com\u002F?imageId=5305212&width=800","2026-10-23T20:04:40+00:00","2026-10-23T21:00:07.64432+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"PHP","product",{"name":21,"type":22},"PHP2Shell","campaign",{"name":24,"type":25},"PHP Foundation","vendor",{"name":27,"type":25},"Google Cloud (Mandiant)",{"name":29,"type":25},"Wiz",{"name":31,"type":25},"Chainguard","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61],{"type":55,"value":56,"context":57},"cve","CVE-2026-115560","Third RCE flaw in PHP requiring unlikely configuration combination; no emergency fix",{"type":55,"value":59,"context":60},"CVE-2026-109618","First PHP2Shell memory-safety RCE vulnerability, patched Wednesday",{"type":55,"value":62,"context":63},"CVE-2026-109619","Second PHP2Shell memory-safety RCE vulnerability, patched Wednesday",[24,27,29],{"controls":66,"vendors":153},[67,96,125],{"slug":68,"name":69,"problem":70,"products":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":97,"name":98,"problem":99,"products":100},"patch-management","Automated patch management","Known holes get closed in days, not months.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":52,"name":126,"problem":127,"products":128},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[154,157],{"slug":146,"name":147,"logo_path":148,"roles":155},[156],"reported_by",{"slug":158,"name":29,"logo_path":159,"roles":160},"wiz","\u002Fvendor-logos\u002Fwiz.png",[156],{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":173},"third-php2shell-rce-bug-highlights-config-hardening-and-patch-cadence-risks","Third PHP2Shell RCE Bug Highlights Config Hardening and Patch Cadence Risks","A third remote code execution vulnerability in PHP (CVE-2026-115560) was discovered alongside two already-exploited bugs, exposing how dangerous default or permissive PHP configuration settings can be when combined with vulnerable application code. While the PHP Foundation declined an emergency patch due to the specific conditions required to trigger this flaw, the broader PHP2Shell situation demonstrates that mass exploitation attempts begin rapidly after disclosure. Organizations relying solely on vendor patch timelines without applying interim mitigations — such as disabling session.upload_progress — remain exposed during the window between disclosure and a regular release. This incident reinforces that secure configuration management is a critical complement to patching, not a substitute for it.",[166,167,168,169,170,171,172],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","CIS Control 4: Secure Configuration of Enterprise Assets and Software",{"NIS2 Article 21(2)(b)":174,"PCI DSS Requirement 6":175,"NIST SP 800-53 SI-2: Flaw Remediation":176,"OWASP A06:2021 Vulnerable and Outdated Components":177,"CIS Control 7: Continuous Vulnerability Management":178,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":179,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":180},"NIS2 mandates incident handling and vulnerability management practices for essential and important entities; the failure to apply interim configuration mitigations while awaiting a patch would fall short of these obligations.","Requirement 6 mandates that organisations develop and maintain secure systems by identifying and addressing vulnerabilities through patching and secure configuration, covering exactly the PHP hardening and patch management gaps exposed here.","SI-2 requires organisations to identify, report, and correct software flaws within defined timeframes, including applying interim workarounds when vendor patches are not yet available — directly applicable to the session.upload_progress mitigation.","Running unpatched or misconfigured PHP versions directly maps to this risk category, which calls for continuous tracking of component versions and applying fixes or compensating controls promptly.","Regular vulnerability scanning would have flagged all three PHP2Shell CVEs promptly, enabling prioritised remediation or mitigation before mass exploitation attempts began.","This control requires organisations to obtain timely information about technical vulnerabilities, evaluate exposure, and take appropriate action — including configuration-level mitigations when a patch is pending.","Disabling dangerous PHP directives like session.upload_progress is a textbook secure configuration action; CIS Control 4 requires organisations to establish and maintain secure configurations to reduce the attack surface exploited in this incident."]