What happened
In a short advisory published on 23 October, PHP disclosed a new vulnerability tracked as CVE-2026-115560. The flaw could allow an attacker to run code on a web server.
The disclosure came just two days after PHP shipped emergency fixes for the bugs known as PHP2Shell.
No emergency fix this time
Unlike the previous two issues, PHP said it will not rush out a fix for this one. The advisory notes that exploiting the bug requires an unusual combination of conditions.
Why it matters
PHP underpins a large share of the web. Back-to-back disclosures show the PHP2Shell crisis is not over, and server administrators should keep a close eye on official advisories and release notes.
