The Hacker News (Security) Oct 23, 2026 · 11:25 AM · 1 min read

PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called

This is a summary aggregated from The Hacker News (Security). Read the complete article on the original site:

Read full article at The Hacker News (Security)

PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

More Cybersecurity News

Authelia returns 11,813 titles on a port that is not supposed to be public

Is Your Cloud Infrastructure an Easy Target for Attackers?

Cyber Insurance's New Reality: Underwriting Isn't Enough

Cloudflare sees millions of attempts to exploit critical PHP flaws

Capcom data breach confirmed — around 11.7 million accounts thought to have been affected

Ethereum Delays Glamsterdam Testnet Fork Over Gas Security Flaws