PHP Warns of Another Unpatched Flaw Two Days After Emergency Fixes for Critical PHP2Shell Vulnerabilities

PHP has warned of another unpatched security flaw that could let hackers take control of vulnerable web servers, just two days after releasing emergency fixes for the critical PHP2Shell vulnerabilities.
The newly discovered flaw, CVE-2026-115560, affects websites using an uncommon technical setup. PHP has urged affected website administrators to disable a specific feature until a security fix is released.
The warning comes as hacking attempts targeting the two earlier PHP2Shell flaws have surged into the millions, according to Cloudflare.
Where things stand:
- The latest flaw affects only an unusual combination of PHP session settings.
- No exploitation of the new vulnerability has been reported.
- PHP recommends disabling session upload progress until its next routine bugfix release.
Unlike the earlier critical flaws, PHP considers the new vulnerability an unlikely attack vector and is not issuing another emergency patch.