PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws, The Hacker News reports. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way; PHP considers it an unlikely risk, is not issuing an emergency fix, and recommends a configuration change instead.