Third PHP2Shell Flaw Found, but PHP Foundation Says No Emergency Fix Is Needed

Researchers have found a third PHP vulnerability that could let attackers take over websites or remotely run malware on vulnerable systems. The PHP Foundation told The Register it has reserved CVE-2026-115560 for the flaw. Unlike the first two PHP2Shell bugs, it will not get an emergency patch. A full advisory and fixed software will arrive with the next regular PHP release.

The Foundation says the issue needs a very unlikely combination of settings and specific application code. An application would have to set session.serialize_handler to php_binary or php_serialize, then switch it to php at runtime before starting a session. The session upload progress feature must also be enabled. Until the next bugfix release, the Foundation advises setting session.upload_progress.enabled=0 to fully protect against this risk. It has published an informational advisory on the PHP website.

The earlier two flaws, CVE-2026-109618 and CVE-2026-109619, are collectively called PHP2Shell. They are memory-safety flaws in PHP, which runs on about 70 percent of websites with a known server-side language. Both were disclosed and patched on Wednesday. Despite reports of mass exploitation attempts and multiple proof-of-concept exploits, no publicly confirmed successful compromises had been attributed to PHP2Shell as of Friday.