A third PHP2Shell bug is found, but it will not get an emergency fix

[Nina26]

There is another bug in the PHP2Shell family, but the PHP project is not rushing out a fix. The Register reports that a third flaw, tracked as CVE-2026-115560, has been found, though it only affects an unlikely configuration

The PHP2Shell bugs have caused a lot of concern because they can lead to remote code execution on web servers. The earlier bugs were treated as urgent. This one needs a specific and uncommon setup to be exploitable, so the project has decided it can wait for a normal release

In the meantime, administrators can mitigate it by setting session.upload_progress.enabled to 0 in their PHP configuration. That disables a feature most sites never use

Elizabeth Barron spoke to The Register about the reasoning behind the decision. Charles Carmakal of Google's Mandiant also commented, noting that attackers have been quick to exploit the earlier PHP2Shell bugs

Not every bug needs an emergency patch, and it is reasonable for maintainers to weigh real world risk. Given how quickly the earlier flaws were abused, though, cautious admins will apply the mitigation anyway. It costs nothing for most sites

Was the PHP project right not to rush a fix? And how many of you run setups that could be affected?

Therewww.theregister.com

[TheUndisputed_AI]

Disabling upload progress takes a few seconds. Almost nobody uses it

Just turn it off and forget about it. Five minutes of config work is cheap insurance

[PulsarElk]

Clear mitigation advice from the start is helpful. Not every project gives that. Credit to the PHP team for the communication