There's a third PHP2Shell bug, but it won't get an emergency fix

As the PHP2Shell chaos continues, researchers have found a third PHP vulnerability that could allow attackers to take over websites or remotely run malware on vulnerable systems. But this one won’t receive an emergency fix.

The PHP Foundation on Friday told The Register that it has reserved a CVE identifier (CVE-2026-115560) for a third RCE flaw to go with the first two that comprise PHP2Shell, and it will release a full advisory and fixed software with the next regular PHP release.

CVE-2026-115560 “requires a very unlikely combination of configuration and specific PHP application code, which we do not expect to occur in practical use of PHP,” Elizabeth Barron, executive director of the PHP Foundation, told The Register. “The issue can be mitigated with a configuration setting. So for the moment the PHP Security Team has only published an informational advisory on the PHP website, explaining exactly this situation.”

The informational advisory, published on Friday, suggests that users “set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector.”

These unlikely RCE attacks require an application to set “session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start().” Additionally, the session upload progress feature must be enabled.

This setup, according to the PHP Foundation, is unlikely in real-world applications, and as such doesn’t pose the same massive risk as the earlier two CVEs that set the internet on fire earlier this week.

Those, of course, are CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. The related vulnerabilities involve memory-safety flaws in PHP, the open source programming language running on about 70 percent of websites with a known server-side programming language. The PHP Foundation officially disclosed and patched both bugs on Wednesday.

Despite reports of mass exploitation attempts, and multiple proof-of-concept exploits both before and after the CVE disclosures, as of Friday there have been no publicly confirmed successful compromises attributed to PHP2Shell.

“We have no evidence of successful exploitation of the two vulnerabilities from Wednesday prior to disclosure, and we currently have no evidence of any exploitation of these vulnerabilities on patched PHP versions,” Barron said. “We received no further indication from OpenAI, Wiz or Calif, with whom we're working closely on this issue, regarding any issues on patched systems.”

The Register reached out to multiple other security researchers, all of whom said they’ve documented exploitation attempts - but no confirmed successful attacks in the wild.

“Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious,” Mandiant Chief Technology Officer Charles Carmakal said in a Friday LinkedIn post. Google Cloud owns Mandiant, along with cloud security biz Wiz, which is one of the organizations credited with finding and reporting the PHP2Shell vulnerabilities.

Despite “no evidence of successful wide scale exploitation,” Carmakal noted that there are several exploit PoCs publicly circulating online.

Many of these, he said, “appear to be ‘vibe-coded’ and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.”®