Experts reveal another major PHP2Shell bug — and it's not getting an emergency patch this time

The PHP Security Team has uncovered a fresh remote code execution (RCE) flaw in PHP, dubbed CVE-2026-115560, but it proves challenging to exploit due to its requirement for a rare and specific configuration setup. Unlike the infamous php2shell vulnerability that sparked panic, this latest bug is unlikely to be abused. To mitigate the risk, users are advised to disable session.upload_progress.enabled until the next regular release.

While the PHP Security Team is working on a fix for php2shell, recent exploits suggest that cybercriminals are still catching up. However, the widespread panic that ensued following the php2shell discovery appears unfounded, as only a few breaches have been reported so far. The success of this exploit may be attributed to Address Space Layout Randomization (ASLR), a security feature that randomizes where a program’s code and data reside in memory, making remote code execution more difficult.