UK — The Register

There's a third PHP2Shell bug, but it won't get an emergency fix

SecurityOctober 24, 20261 min read

Researchers found a third bug in PHP, the popular web programming language. It is a remote code execution flaw, which means an attacker could run their own code on a server. The PHP Foundation will not rush an emergency fix because the bug is very hard to trigger.

A third bug, but no rush fix

Researchers found a third PHP bug while the PHP2Shell problem was already causing trouble. It could let attackers take over websites or run malware on vulnerable systems. The PHP Foundation, the group that runs PHP, said it will fix this bug in the next regular PHP release, not in an emergency update.

Key facts

The new bug is called CVE-2026-115560.
The first two bugs, CVE-2026-109618 and CVE-2026-109619, make up PHP2Shell.
PHP runs on about 70 percent of websites that use a known server-side language.
As of Friday, no confirmed successful attacks from PHP2Shell were publicly reported.

What is PHP2Shell?

PHP is an open source language. Open source means anyone can read and use its code. PHP2Shell is the name for two serious bugs that involve memory safety. Memory safety bugs happen when a program handles computer memory in an unsafe way. The PHP Foundation patched both bugs on Wednesday.

Why it matters

The new bug is much less risky than the first two. It needs a rare mix of settings and special application code that most sites do not use. Still, website owners can turn off one setting to be safe until the next update. Security experts also warn that attacks may have already started in a small way, so keeping systems updated is important.

What to watch

The next regular PHP release, which will include the full advisory and fix for CVE-2026-115560.
Whether any confirmed attacks from PHP2Shell appear in the wild.
Whether site owners turn off the session upload progress setting until the fix arrives.

Glossary

PHP: A popular open source programming language used to run many websites.
PHP Foundation: The group that manages and maintains the PHP language.
CVE: A public ID number given to a known security flaw so people can track it.

Tioli Releases Emergency Response Guide for 'Node2Shell'

Tioli said on the 26th that it had independently reproduced and verified the Node.js vulnerability 'Node2Shell (CVE-2026-111497)', disclosed on the 21st, and published a response guide. The flaw stems from a memory-handling error when decompressing Brotli-compressed data, and Node.js rates its severity as High. Patched versions 22.23.4, 24.22.1, and 26.12.1 were released.

Security전자신문Oct 26

Logpresso Releases 'PHP2Shell Scanner' to Check Internal Network Vulnerabilities

Logpresso has released a 'PHP2Shell Scanner' app that diagnoses the PHP remote code execution vulnerabilities known as PHP2Shell. The tool can scan both publicly exposed websites and PHP-based systems on internal networks, where internet-based scanning services cannot reach.

SecurityVnExpressOct 26

The Privacy Risks of "Always-Listening" AI Devices

AI-enabled devices such as smart speakers, smartwatches and smart glasses that are always ready to respond can collect data, raising privacy concerns. Global shipments of AI glasses reportedly jumped to 8.4 million in 2025 from 2.1 million in 2024, according to Omdia data cited by Reuters. Experts warn that bystanders may be monitored without owning any device, and that AI can interpret far more collected information than earlier voice assistants.