PHP uncovers new way to execute code on servers two days after patching two critical flaws

The PHP project disclosed a new code execution vulnerability (CVE-2026-115560) affecting specific configurations just two days after emergency patches for two critical PHP2Shell flaws. Administrators are advised to disable the session upload progress feature temporarily while awaiting a regular patch, with older PHP versions also urged to apply updates to mitigate high-severity security risks exploited rapidly in the wild.

This Wire brief sits within Fusion42's coverage of Cybersecurity and Enterprise Software, and 32 sources have reported it between 21 Oct 2026 and 24 Oct 2026.