There's a third PHP2Shell bug, but it won't get an emergency fix

A third PHP vulnerability has emerged, posing a risk of attackers taking over websites and running remote malware. However, this flaw will not receive an emergency fix. The PHP Foundation has reserved a CVE identifier (CVE-2026-115560) for the third remote code execution (RCE) flaw, alongside the first two that form the PHP2Shell issue. Executive director Elizabeth Barron stated that the vulnerability requires an unlikely configuration and specific PHP application code, which is not expected in practical use.

The issue can be mitigated by disabling the session.upload_progress.enabled setting until the next regular PHP bugfix release. This setup, according to the PHP Foundation, is unlikely in real-world applications and doesn't pose the same risk as the earlier two CVEs. Both of those vulnerabilities, CVE-2026-109618 and CVE-2026-109619, involve memory-safety flaws in PHP, which runs on approximately 70% of websites with a known server-side programming language.

Despite reports of mass exploitation attempts and multiple proof-of-concept exploits, there have been no publicly confirmed successful compromises attributed to PHP2Shell as of Friday. The PHP Foundation has not received any further indications from OpenAI, Wiz, or Calif regarding issues on patched systems. While security researchers claim to have documented exploitation attempts, there is no evidence of successful attacks in the wild.

However, Mandiant Chief Technology Officer Charles Carmakal warned that the threat is serious and may have already begun in a limited fashion, with several exploit PoCs publicly circulating online.