[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6YEVw_paYf5RxwzfB3LGhTbSKloLAuY97K7yrzDqHQk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"9ebc145f-531b-4868-aa88-881887f9947a","third-php2shell-rce-bug-highlights-config-hardening-and-patch-cadence-risks","c1dbd6dd-3261-49b9-b6d2-f29751094969","Third PHP2Shell RCE Bug Highlights Config Hardening and Patch Cadence Risks","A third remote code execution vulnerability in PHP (CVE-2026-115560) was discovered alongside two already-exploited bugs, exposing how dangerous default or permissive PHP configuration settings can be when combined with vulnerable application code. While the PHP Foundation declined an emergency patch due to the specific conditions required to trigger this flaw, the broader PHP2Shell situation demonstrates that mass exploitation attempts begin rapidly after disclosure. Organizations relying solely on vendor patch timelines without applying interim mitigations — such as disabling session.upload_progress — remain exposed during the window between disclosure and a regular release. This incident reinforces that secure configuration management is a critical complement to patching, not a substitute for it.","**Immediate actions:**\n- Disable `session.upload_progress` in `php.ini` on all PHP servers as an interim mitigation for CVE-2026-115560 until the official patch ships.\n- Apply available patches for CVE-2026-109618 and CVE-2026-109619 immediately and verify patched systems are not compromised.\n\n**Configuration hardening:**\n- Audit all PHP configuration files (`php.ini`) against a secure baseline, disabling unused or dangerous directives such as file upload handling where not required.\n- Implement infrastructure-as-code or configuration management tools (e.g., Ansible, Chef) to enforce and drift-detect secure PHP configurations across all servers.\n\n**Detection and monitoring:**\n- Deploy web application firewall (WAF) rules and IDS signatures targeting PHP2Shell exploitation patterns to detect mass exploitation attempts in real time.\n- Enable centralised logging of PHP errors and application-level anomalies and alert on unexpected file upload or session-related activity.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","CIS Control 4: Secure Configuration of Enterprise Assets and Software",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":26},"NIS2 mandates incident handling and vulnerability management practices for essential and important entities; the failure to apply interim configuration mitigations while awaiting a patch would fall short of these obligations.","Requirement 6 mandates that organisations develop and maintain secure systems by identifying and addressing vulnerabilities through patching and secure configuration, covering exactly the PHP hardening and patch management gaps exposed here.","SI-2 requires organisations to identify, report, and correct software flaws within defined timeframes, including applying interim workarounds when vendor patches are not yet available — directly applicable to the session.upload_progress mitigation.","Running unpatched or misconfigured PHP versions directly maps to this risk category, which calls for continuous tracking of component versions and applying fixes or compensating controls promptly.","Regular vulnerability scanning would have flagged all three PHP2Shell CVEs promptly, enabling prioritised remediation or mitigation before mass exploitation attempts began.","This control requires organisations to obtain timely information about technical vulnerabilities, evaluate exposure, and take appropriate action — including configuration-level mitigations when a patch is pending.","Disabling dangerous PHP directives like session.upload_progress is a textbook secure configuration action; CIS Control 4 requires organisations to establish and maintain secure configurations to reduce the attack surface exploited in this incident.","published","2026-10-23T21:21:04.236682+00:00","2026-10-23T21:21:04.214+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F10\u002F23\u002Ftheres-a-third-php2shell-bug-but-it-wont-get-an-emergency-fix\u002F5305208","there-s-a-third-php2shell-bug-but-it-won-t-get-an-emergency-fix-77a47a","There's a third PHP2Shell bug, but it won't get an emergency fix",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,53,56],{"slug":50,"name":51,"problem":52},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":44,"name":54,"problem":55},"Automated patch management","Known holes get closed in days, not months.",{"slug":57,"name":58,"problem":59},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]