URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

T2Covered by 1 source · first reported by The Hacker News at 23 Oct, 11:25 UTC

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The…