[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRc20CDilg5tQ1DwnHoTuSvgIenSV8aBe7j3AS7XkXaM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":54},"23832d4f-b3af-4bf7-b5af-036a9f321fb2","php-issues-second-rce-warning-days-after-emergency-patches","e3929bcc-5668-4b10-b296-c505a8fdb054","PHP Issues Second RCE Warning Days After Emergency Patches","Just two days after PHP released emergency patches for critical PHP2Shell RCE flaws, a second unpatched RCE vulnerability (CVE-2026-115560) was disclosed, leaving organizations in a difficult position with no patch available. While the risk is limited to unusually configured web applications, the absence of an emergency fix means organizations must rely on configuration-based mitigations — specifically disabling a particular feature — rather than a traditional patch. This incident highlights the compounding risk of rapid vulnerability disclosures and the danger of relying solely on vendor patches as the primary defense. It underscores the critical need for defense-in-depth strategies, including hardened configurations and proactive feature disablement, to reduce attack surface when patches are unavailable.","**Immediate actions:**\n- Apply the vendor-recommended mitigation of disabling the specified PHP feature on all affected web servers immediately.\n- Audit all PHP-based web application configurations to identify and remediate any non-standard or risky settings that increase exposure.\n- Prioritize completing the emergency PHP2Shell patches on all remaining unpatched systems before addressing the new CVE.\n\n**Long-term improvements:**\n- Establish a formal vulnerability management process that includes vendor-workaround procedures for zero-day and unpatched vulnerabilities.\n- Maintain a current, accurate inventory of all web-facing applications, their runtime environments, and configuration baselines to accelerate response.\n- Adopt a secure-by-default configuration policy that disables non-essential or high-risk features in web application runtimes at deployment.\n\n**Detection measures:**\n- Deploy web application firewalls (WAF) with rules tuned to detect RCE exploitation attempts targeting PHP-based applications.\n- Implement continuous vulnerability scanning of internet-facing assets to detect newly disclosed CVEs within 24 hours of publication.\n- Enable detailed logging of PHP runtime errors and anomalous web requests, and alert on patterns consistent with RCE exploitation attempts.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires entities to implement incident handling and vulnerability disclosure management practices, including timely response to unpatched vulnerabilities affecting critical network and information systems.","PCI DSS Requirement 6 mandates that organizations protect systems and software from known vulnerabilities through patching and, where patches are unavailable, through documented risk-based mitigations.","SI-2 requires organizations to have a process for remediating flaws when patches are unavailable, including applying vendor-recommended mitigations such as disabling the affected PHP feature.","Running PHP components with known RCE vulnerabilities and non-default risky configurations directly reflects the risk of using vulnerable and improperly hardened software components in web applications.","Continuously scanning for newly disclosed vulnerabilities and tracking unpatched CVEs like CVE-2026-115560 would have ensured rapid identification and workaround application before exploitation could occur.","A.8.8 requires timely identification and treatment of technical vulnerabilities, including applying workarounds when no patch exists, directly applicable to this unpatched RCE scenario.","Restricting which features and configurations are enabled in PHP environments reduces the attack surface exposed by this vulnerability while awaiting an official patch.","published","2026-10-23T12:20:24.854454+00:00","2026-10-23T12:20:24.828+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Furgent-php-warns-of-another-unpatched.html","urgent-php-warns-of-another-unpatched-rce-two-days-after-emergency-php2shell-pat-d3e6fb","URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":48,"name":49,"slug":50,"description":51,"color":52},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[55,58,61],{"slug":38,"name":56,"problem":57},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":50,"name":59,"problem":60},"Automated patch management","Known holes get closed in days, not months.",{"slug":62,"name":63,"problem":64},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]