vulnerability
URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
HighCVSS 9.8
Summary
PHP has identified a new, low-risk vulnerability (CVE-2026-115560) that could allow code execution on web servers, but it’s unlikely to be exploited. This vulnerability is separate from the previously patched PHP2Shell flaws, which have seen increased exploitation attempts.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data
Also covered by 22 other source(s)
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
- PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
- Critical Vulnerabilities in PHP Require Immediate Patching
- Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
- PHP2Shell : deux failles critiques menacent les serveurs web
- PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
- PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched
- Two critical RCEs in PHP core
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
- Widespread PHP Flaw May Cause Many Site Outages Today
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
- PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024
- 'PHP2Shell' Bugs Signal Red Alert for Security Industry
- PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
- Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
- PHP2Shell Exploitation Started Days Before Patches
- Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
- Tech and Security Companies Respond to PHP2Shell Vulnerabilities
- New Serious PHP Vulnerabilities Released and Patched
- PHP2Shell puts dozens of UK government services out of service
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge