[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0ayLQSuLMGGrOME2eNMcICPddXwUsY0rfBAVS84Je2U":3},{"article":4,"iocs":28,"watch_terms":33,"solutions":34,"lesson":124},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"e3929bcc-5668-4b10-b296-c505a8fdb054","URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches","urgent-php-warns-of-another-unpatched-rce-two-days-after-emergency-php2shell-pat-d3e6fb","PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called","PHP has issued a warning about a new remote code execution (RCE) vulnerability, CVE-2026-115560, just two days after releasing emergency patches for the critical PHP2Shell flaws. While this new vulnerability affects only web applications configured in an unusual way and is considered an unlikely risk, it remains unpatched. PHP has stated it will not be issuing an emergency fix and recommends disabling a specific feature.","PHP warns of a new unpatched RCE vulnerability, CVE-2026-115560, two days after fixing PHP2Shell.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Furgent-php-warns-of-another-unpatched.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhSXE1XecomGt7TSLi_DCDVL8oQjsLEtppNNGjkuW1cbVl-cXZkMG-rqTr-oSVz_6XfoU8aoScw3rjGxsnTpV3JaV5eWfj431lg09Rnrrk1UjwNq1ZEofkwR4FaM2qatC_FD9ZNBZk-T9_9ddu8n-BtUkhwVgWzc2ZvaWAHP8eMxlLU19qxIjlXeHOJYHs\u002Fs1600\u002Fphp2.jpg","2026-10-23T11:25:43+00:00","2026-10-23T12:00:12.307381+00:00",7,[17],{"name":18,"type":19},"PHP","product","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":20,"icon":22,"name":23,"slug":24},null,"Vulnerabilities","vulnerabilities",[26],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},[29],{"type":30,"value":31,"context":32},"cve","CVE-2026-115560","New unpatched RCE vulnerability in PHP",[18],{"controls":35,"vendors":123},[36,65,94],{"slug":37,"name":38,"problem":39,"products":40},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[41,49,57],{"vendor_slug":42,"vendor_name":43,"vendor_logo":44,"product_slug":45,"product_name":46,"url":47,"description":48},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":53,"product_name":54,"url":55,"description":56},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":66,"name":67,"problem":68,"products":69},"patch-management","Automated patch management","Known holes get closed in days, not months.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[],{"slug":125,"title":126,"body":127,"framework_refs":128,"framework_notes":136},"php-issues-second-rce-warning-days-after-emergency-patches","PHP Issues Second RCE Warning Days After Emergency Patches","Just two days after PHP released emergency patches for critical PHP2Shell RCE flaws, a second unpatched RCE vulnerability (CVE-2026-115560) was disclosed, leaving organizations in a difficult position with no patch available. While the risk is limited to unusually configured web applications, the absence of an emergency fix means organizations must rely on configuration-based mitigations — specifically disabling a particular feature — rather than a traditional patch. This incident highlights the compounding risk of rapid vulnerability disclosures and the danger of relying solely on vendor patches as the primary defense. It underscores the critical need for defense-in-depth strategies, including hardened configurations and proactive feature disablement, to reduce attack surface when patches are unavailable.",[129,130,131,132,133,134,135],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":137,"PCI DSS Requirement 6":138,"NIST SP 800-53 SI-2: Flaw Remediation":139,"OWASP A06:2021 Vulnerable and Outdated Components":140,"CIS Control 7: Continuous Vulnerability Management":141,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":142,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":143},"NIS2 requires entities to implement incident handling and vulnerability disclosure management practices, including timely response to unpatched vulnerabilities affecting critical network and information systems.","PCI DSS Requirement 6 mandates that organizations protect systems and software from known vulnerabilities through patching and, where patches are unavailable, through documented risk-based mitigations.","SI-2 requires organizations to have a process for remediating flaws when patches are unavailable, including applying vendor-recommended mitigations such as disabling the affected PHP feature.","Running PHP components with known RCE vulnerabilities and non-default risky configurations directly reflects the risk of using vulnerable and improperly hardened software components in web applications.","Continuously scanning for newly disclosed vulnerabilities and tracking unpatched CVEs like CVE-2026-115560 would have ensured rapid identification and workaround application before exploitation could occur.","A.8.8 requires timely identification and treatment of technical vulnerabilities, including applying workarounds when no patch exists, directly applicable to this unpatched RCE scenario.","Restricting which features and configurations are enabled in PHP environments reduces the attack surface exposed by this vulnerability while awaiting an official patch."]