URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
Summary
PHP has alerted users to a new unpatched remote code execution vulnerability, CVE-2026-115560. This vulnerability affects web applications with specific unusual configurations and is considered a low risk by PHP. The project is not planning an emergency patch but recommends disabling a particular feature.
IFF Assessment
A newly disclosed unpatched remote code execution vulnerability poses a risk to web servers, representing bad news for defenders.
Severity
This CVSS score of 7.5 reflects a High severity for a Remote Code Execution (RCE) vulnerability, considering potential attack vector and impact on confidentiality, integrity, and availability, even if the affected configuration is unusual.
Defender Context
Defenders should be aware of new RCE vulnerabilities, especially those that emerge shortly after critical patches. While this specific vulnerability has a limited scope, it highlights the ongoing risk of code execution flaws in widely used software like PHP. Organizations should monitor for any potential exploitation attempts and apply recommended mitigations promptly.