PHP turns out to have a third memory vulnerability, but the maintainers of the programming language see no reason to panic. A patch will arrive with the next release.
These are busy days for the security team behind the PHP programming language. Two vulnerabilities caused global panic last week, but there turns out to be a third one as well. PHP shared more information about it on Friday. According to PHP, there is no reason to panic.
The third vulnerability, tracked as CVE-2026-115560, also involves memory. According to PHP, however, this vulnerability is far less dangerous and an emergency patch like last week’s is not needed. It can only be exploited ‘through an exceptional combination of configurations and code’, PHP writes in the security advisory.
A patch for the vulnerability will therefore only be rolled out with the next release. Until then, PHP says you only need to check whether the specific setting session.upload_progress.enabled is set to ‘0’, and if so, leave it alone. The same mitigation was also advised for the previous vulnerabilities before the patch became available.
PHPShell still reverberating
Meanwhile, it remains to be seen what impact the ‘PHP2Shell’ vulnerabilities will have. The potential attack surface is large: an estimated 70 percent of all websites on the internet use PHP code. That does not mean all those websites necessarily have vulnerable or internet-facing instances.
The vulnerabilities were reportedly already probed and/or exploited before the patch was rolled out. According to Amazon, even as early as four days before the patch was released. The security company Chainguard shared more information on its own initiative, which PHP was not pleased about. The organisation behind the programming language is also facing criticism itself, because it had known about at least one vulnerability since 2024.
Major incidents have not occurred so far, and we can only hope it stays that way. Several independent researchers claim that PHP’s emergency patch is incomplete and does not fully nip the danger in the bud. PHP disagrees. The race also only really begins once a patch is available, because administrators have to install it in time.