{
  "id": 16236095,
  "title": "There's a third PHP2Shell bug, but it won't get an emergency fix",
  "url": "https://urgent.news/2026/10/23/theres-a-third-php2shell-bug-but-it-wont-get-an-emergency-fix",
  "topic": "science",
  "section": "Science",
  "published": "2026-10-23T20:04:40.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/10/23/theres-a-third-php2shell-bug-but-it-wont-get-an-emergency-fix/5305208"
  },
  "original_language": "en",
  "account": "The PHP2Shell cyber threat has escalated, with researchers uncovering a third PHP vulnerability that could enable attackers to gain control of websites or run malware remotely. However, this latest flaw won't be addressed with an emergency patch. The PHP Foundation has assigned the identifier CVE-2026-115560 to the third remote code execution (RCE) flaw, alongside the initial two that make up PHP2Shell. According to Elizabeth Barron, the PHP Foundation's executive director, the new vulnerability demands an exceptionally rare configuration and specific PHP application code, unlikely to occur in practice. Nevertheless, the PHP Security Team has issued an advisory explaining the situation, recommending users disable the session.upload_progress.enabled option until the next regular PHP bugfix release. The experts emphasize that these extremely rare RCE attacks necessitate a particular configuration, wherein an application sets \"session.serialize_handler to php_binary or php_serialize\" and then changes it to php via ini_set() before calling session_start(). Furthermore, the session upload progress feature must be enabled. The PHP Foundation's researchers claim that such setup is improbable in real-world applications, so it doesn't pose the same catastrophic risk as the prior two CVEs, collectively known as PHP2Shell. These vulnerabilities involve memory-safety flaws in PHP, the open-source programming language powering around 70% of websites with server-side programming languages. Both bugs were discovered and fixed by the PHP Foundation on Wednesday. Despite claims of attempted mass exploitation and proof-of-concept exploits before and after the CVE disclosures, no successful compromise attributed to PHP2Shell has been confirmed as of Friday. The PHP Foundation did not receive further information from OpenAI, Wiz, or Calif about any exploits on patched systems. Security researchers concur with the PHP Foundation's assessment, with many documenting attempted exploits but no confirmed successful attacks in the wild. Nevertheless, some experts raise concerns, stating that exploitation might already have begun covertly, and the threat remains viable and serious.",
  "summary": "Bad things (and software bugs?) come in threes",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}