PHP warns of another unpatched RCE, two days after the php2shell patches
CVE-2026-115560 has urgent mitigation guidance out.
The Hacker News (@TheHackersNews) posted on Friday that PHP warned of another unpatched remote code execution bug, tracked as CVE-2026-115560, just two days after the emergency php2shell patches. The post says urgent mitigation guidance is out. It drew about 5,900 likes.
Another post on the board from the PHP Foundation suggests setting session.upload_progress.enabled=0 until the next release.
Why it mattersPHP runs a large share of websites, so operators should check the project's guidance and apply the mitigation.
