Experts reveal another major PHP2Shell bug — and it's not getting an emergency patch this time
- PHP disclosed a new RCE vulnerability, but exploitation requires a rare and specific configuration setup
- Unlike php2shell, the flaw will be fixed in the next regular release rather than an emergency patch
- Researchers say php2shell attacks remain limited so far, though widespread patching is still urgently needed
The PHP Security Team has discovered yet another remote code execution (RCE) vulnerability in the now-notorious programming code, but since the issue is not that easy to abuse, it won’t receive an out-of-bounds fix.
The organization recently published a new security advisory warning users about a session upload progress bug in PHP, tracked as CVE-2026-115560. In the advisory, the organization said the bug can only be abused “under an unusual combination of configuration and application code”.
“An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload...
Copyright of this story solely belongs to www.techradar.com. To see the full text click HERE
