A newly reported PHP2Shell-related flaw is said to be capable of remote code execution on web servers, though it only works under specific, described-as unlikely conditions. TechRadar reports that security experts have identified “another major” issue and notes that an emergency patch is not being issued this time.
The Next Web adds context by describing a third PHP2Shell flaw for which PHP issues an advisory but does not plan a rapid fix. It says the warning comes shortly after PHP’s emergency fixes for earlier PHP2Shell vulnerabilities, and that this new issue is identified as CVE-2026-115560. Across the coverage, the key emphasis is on impact and exploit conditions—remote code execution is possible, but the practical risk depends on the “unusual” setup required, leading to different expectations about urgency for remediation.
Overall, outlets align on the core points: multiple PHP2Shell weaknesses have been disclosed, PHP has publicly warned again, and the latest issue is not prompting an immediate emergency response because of its constrained triggering requirements.
