PHP warns of a third PHP2Shell flaw but won’t rush out a fix

T2Covered by 1 source · first reported by TNW at 26 Oct, 11:25 UTC

PHP has warned of a third flaw that could let an attacker run code on a web server, two days after its emergency fixes for the PHP2Shell bugs. This time it will not rush out a fix. In a short advisory on 23 October, PHP said the new bug, CVE-2026-115560, needs an unusual mix of […] This story…