PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

PHP has disclosed a new remote code execution vulnerability tracked as CVE-2026-115560, just two days after issuing emergency patches for the critical PHP2Shell flaws. The new issue affects web applications configured in an unusual manner and is considered an unlikely risk by the PHP project. Unlike the previous PHP2Shell vulnerabilities, PHP is not issuing an emergency fix for this new issue. Instead, the project recommends disabling a specific feature as a mitigation measure. The disclosure highlights ongoing security concerns within the PHP ecosystem following the recent emergency patch cycle.