PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches

PHP warns of a new, unlikely code execution flaw, CVE-2026-115560, and advises disabling session upload progress until a fix is released. PHP has warned of a new code execution vulnerability, tracked as CVE-2026-115560, just two days after releasing emergency patches for the critical PHP2Shell flaws.

Reported so far by one publisher.

Summary from Security Affairs.

Reporting1

SAF Security Affairs PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches · Pierluigi Paganini 2:07 PM

Related

UAI PHP releases patches for two critical flaws uncovered using AI October 20

THN GitLab fixes CVSS 10.0 flaw allowing code execution without login October 12

BC GitLab warns of new max severity code execution vulnerability October 21

CSN Multiple Google Chrome Flaws Could Enable Memory Corruption and Code Execution Attacks October 14