⚠️PHP2Shell Vulnerability: New RCE Flaw Found, No Immediate Fix
PHP2Shell: New RCE Flaw, No Fix Yet
TL;DR
PHP2Shell, a new RCE vulnerability, has been discovered but won't get an emergency fix. PHP Foundation has reserved a CVE identifier (CVE-2026-115560) for the third RCE flaw. Mitigation requires setting 'session.upload_progress.enabled=0'.
PHP2Shell, a new Remote Code Execution (RCE) vulnerability, has been discovered in PHP, but there's no immediate fix coming. The PHP Foundation has reserved a CVE identifier (CVE-2026-115560) for the third RCE flaw. This vulnerability requires a very unlikely combination of configuration and specific PHP application code, making it less of an immediate threat. However, the PHP Foundation advises setting 'session.upload_progress.enabled=0' to mitigate the risk until the next regular bugfix release. Despite the low likelihood of exploitation, the threat is serious and several proof-of-concept exploits are circulating online. The PHP community is on high alert, but the real-world impact remains to be seen.
Key Points
PHP2Shell, a new RCE flaw, has been discovered (CVE-2026-115560).
No emergency fix is planned; mitigation requires setting 'session.upload_progress.enabled=0'.
Exploitation requires specific PHP application code and configuration, making it unlikely in real-world apps.
Multiple PoCs are circulating, but many are 'vibe-coded' and incapable of RCE.
No confirmed successful attacks in the wild as of Friday, despite reports of exploitation attempts.
Why It Matters
If you're running PHP applications with session.upload_progress enabled, setting 'session.upload_progress.enabled=0' is crucial until the next bugfix release. Despite the low likelihood of exploitation, the threat is serious and requires immediate attention from security teams.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,567 builders reading daily.