PHP Issues Second RCE Warning Days After Emergency Patches
Just two days after PHP released emergency patches for critical PHP2Shell RCE flaws, a second unpatched RCE vulnerability (CVE-2026-115560) was disclosed, leaving organizations in a difficult position with no patch available. While the risk is limited to unusually configured web applications, the absence of an emergency fix means organizations must rely on configuration-based mitigations — specifically disabling a particular feature — rather than a traditional patch. This incident highlights the compounding risk of rapid vulnerability disclosures and the danger of relying solely on vendor patches as the primary defense. It underscores the critical need for defense-in-depth strategies, including hardened configurations and proactive feature disablement, to reduce attack surface when patches are unavailable.
Tactical Insight
Immediate actions
- Apply the vendor-recommended mitigation of disabling the specified PHP feature on all affected web servers immediately.
- Audit all PHP-based web application configurations to identify and remediate any non-standard or risky settings that increase exposure.
- Prioritize completing the emergency PHP2Shell patches on all remaining unpatched systems before addressing the new CVE.
Long-term improvements
- Establish a formal vulnerability management process that includes vendor-workaround procedures for zero-day and unpatched vulnerabilities.
- Maintain a current, accurate inventory of all web-facing applications, their runtime environments, and configuration baselines to accelerate response.
- Adopt a secure-by-default configuration policy that disables non-essential or high-risk features in web application runtimes at deployment.
Detection measures
- Deploy web application firewalls (WAF) with rules tuned to detect RCE exploitation attempts targeting PHP-based applications.
- Implement continuous vulnerability scanning of internet-facing assets to detect newly disclosed CVEs within 24 hours of publication.
- Enable detailed logging of PHP runtime errors and anomalous web requests, and alert on patterns consistent with RCE exploitation attempts.