Security1 hOctober 23, 2026, 18:25

PHP warns of another unpatched RCE two days after emergency PHP2Shell fixes

PHP has disclosed a new code-execution flaw, CVE-2026-115560, two days after shipping emergency patches for the critical PHP2Shell bugs. The issue affects only unusually configured web applications, so no emergency fix is planned; the project advises disabling the affected feature.

The Hacker News

Open source

PHP warns of another unpatched RCE two days after emergency PHP2Shell fixes

The flaw is tracked as CVE-2026-115560
Only web apps with unusual configuration are affected
No emergency patch planned; disabling the feature is advised

#PHP

Two Unpatched Citrix NetScaler RCE Zero-Days Actively Exploited

Security

Mirai botnet joins PHP2Shell attacks as ASLR bypass exploit emerges

Security

PHP warns of two critical flaws, emergency patches due October 21

Security

PHP warns of another unpatched RCE two days after emergency PHP2Shell fixes

Two Unpatched Citrix NetScaler RCE Zero-Days Actively Exploited

Mirai botnet joins PHP2Shell attacks as ASLR bypass exploit emerges

PHP warns of two critical flaws, emergency patches due October 21

PHP2Shell exploit bypasses ASLR to achieve RCE on PHP 8.4.26 servers