PHP discloses a third PHP2Shell flaw but won't rush out a fix
PHP disclosed a third vulnerability, CVE-2026-115560, on 23 October, just two days after emergency fixes for the PHP2Shell bugs. This time the project says it will not rush out a patch, noting the flaw requires an unusual combination of conditions.
