URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP warns of a new unpatched RCE vulnerability, CVE-2026-115560, two days after fixing PHP2Shell.
Run PHP?
Get an email when a reviewed story names PHP, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
PHP has issued a warning about a new remote code execution (RCE) vulnerability, CVE-2026-115560, just two days after releasing emergency patches for the critical PHP2Shell flaws. While this new vulnerability affects only web applications configured in an unusual way and is considered an unlikely risk, it remains unpatched. PHP has stated it will not be issuing an emergency fix and recommends disabling a specific feature.
The lesson from this incident
Full lessonJust two days after PHP released emergency patches for critical PHP2Shell RCE flaws, a second unpatched RCE vulnerability (CVE-2026-115560) was disclosed, leaving organizations in a difficult position with no patch available. While the risk is limited to unusually configured web applications, the absence of an emergency fix means organizations must rely on configuration-based mitigations — specifically disabling a particular feature — rather than a traditional patch. This incident highlights the compounding risk of rapid vulnerability disclosures and the danger of relying solely on vendor patches as the primary defense. It underscores the critical need for defense-in-depth strategies, including hardened configurations and proactive feature disablement, to reduce attack surface when patches are unavailable.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-115560