Third PHP2Shell RCE Bug Highlights Config Hardening and Patch Cadence Risks
A third remote code execution vulnerability in PHP (CVE-2026-115560) was discovered alongside two already-exploited bugs, exposing how dangerous default or permissive PHP configuration settings can be when combined with vulnerable application code. While the PHP Foundation declined an emergency patch due to the specific conditions required to trigger this flaw, the broader PHP2Shell situation demonstrates that mass exploitation attempts begin rapidly after disclosure. Organizations relying solely on vendor patch timelines without applying interim mitigations — such as disabling session.upload_progress — remain exposed during the window between disclosure and a regular release. This incident reinforces that secure configuration management is a critical complement to patching, not a substitute for it.
Tactical Insight
Immediate actions
- Disable `session.upload_progress` in `php.ini` on all PHP servers as an interim mitigation for CVE-2026-115560 until the official patch ships.
- Apply available patches for CVE-2026-109618 and CVE-2026-109619 immediately and verify patched systems are not compromised.
Configuration hardening
- Audit all PHP configuration files (`php.ini`) against a secure baseline, disabling unused or dangerous directives such as file upload handling where not required.
- Implement infrastructure-as-code or configuration management tools (e.g., Ansible, Chef) to enforce and drift-detect secure PHP configurations across all servers.
Detection and monitoring
- Deploy web application firewall (WAF) rules and IDS signatures targeting PHP2Shell exploitation patterns to detect mass exploitation attempts in real time.
- Enable centralised logging of PHP errors and application-level anomalies and alert on unexpected file upload or session-related activity.