PHP warns of third PHP2Shell flaw but won't rush out a fix

PHP disclosed a third PHP2Shell vulnerability, CVE-2026-115560, which requires an unusual mix of settings: switching the session serialize handler to 'php' at runtime and enabling session upload progress. The fix will ship in the next routine release; admins are advised to disable session upload progress meanwhile. The first two flaws were patched on 21 October in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

• CVE-2026-115560 needs the 'php' session handler and session upload progress enabled
• The fix will arrive in the next routine release, not as an emergency patch
• The first two flaws were fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35
• CYFIRMA: a North Korea-linked group scans 216 servers from 21 machines