« previous next »
Pages: [1]

Author Topic: PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patch  (Read 159 times)

0 Members and 1 Guest are viewing this topic.

Offline
Starburst
*****
PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patch
« on: October 23, 2026, 06:57:19 PM »
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws.

The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.

The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called session upload progress until a fix is available in the next routine release.

Full Article at:
https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html
Logged
Offline
overseer
*****
Re: PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patch
« Reply #1 on: October 23, 2026, 10:59:07 PM »
As I have said, let the year of AI fuzzing roll on! No surprise, to be expected.
Logged
Offline
Starburst
*****
Re: PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patch
« Reply #2 on: October 24, 2026, 08:12:32 PM »
Logged
Offline
overseer
*****
Re: PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patch
« Reply #3 on: October 24, 2026, 08:51:03 PM »
TL;DR: In every php.ini, set:
Code: [Select]
session.upload_progress.enabled = Off
Logged
Pages: [1]
« previous next »