PHP Flags Third Server Bug as PHP2Shell Attacks Surge

PHP Discovers Another Security Issue

PHP maintainers have disclosed a new server vulnerability identified as CVE-2026-115560. This announcement arrived just two days after the team rushed out emergency patches for two critical security flaws known as PHP2Shell.

Security researchers noticed millions of exploitation attempts targeting those initial PHP2Shell bugs. The rapid discovery of a third issue highlights ongoing security challenges across web infrastructure.

What Is the New Bug CVE-2026-115560?

The newly identified bug, CVE-2026-115560, poses a significant technical threat under specific conditions. If successfully exploited, it can allow malicious attackers to take full control of an affected web server.

However, the vulnerability is not universally applicable across all systems. It requires a website to run a very rare combination of custom PHP session settings.

Because of these specific requirements, the actual risk footprint remains relatively constrained compared to broader server vulnerabilities.

Are Attackers Exploiting the New Flaw?

Fortunately, cybersecurity monitoring teams have not detected any active real-world attacks using CVE-2026-115560 so far.

This contrasts sharply with the earlier PHP2Shell flaws, which triggered millions of automated exploitation attempts globally almost immediately after becoming public knowledge.

Understanding the Context of PHP2Shell

PHP remains one of the most widely used programming languages on the internet today. It powers millions of popular sites, web applications, and underlying server frameworks.

When critical bugs like the PHP2Shell vulnerabilities appear, automated botnets move quickly to scan the web for unpatched machines.

System administrators are urged to keep their server environments updated to the latest official PHP versions to protect against potential exploits.