Third PHP2Shell bug found, but no emergency fix planned

The PHP Foundation reserved CVE-2026-115560 for a third RCE flaw tied to PHP2Shell. Exploitation requires an unlikely configuration combination, so the fix will ship in the next regular PHP release; users are advised to disable session.upload_progress meanwhile.

• Third RCE tracked as CVE-2026-115560, fix due in regular PHP release
• Attack requires switching session.serialize_handler to php at runtime
• Mitigation: set session.upload_progress.enabled=0 until patched
• No confirmed successful PHP2Shell compromises so far