ctrlINT What the industry said about every indicator, with the quote

CVE-2026-115560Vulnerability

Reported by 3 independent sources · first reported by The Hacker News · last reported

Last reported yesterday

What the reports say

3 reports, newest first · the exact sentence from each

  1. “The PHP Foundation on Friday told The Register that it has reserved a CVE identifier (CVE-2026-115560) for a third RCE flaw to go with the first two that comprise PHP2Shell, and it will release a full advisory and fixed software with the next regular PHP release.”

    The Register (security)News
    There's a third PHP2Shell bug, but it won't get an emergency fix

  2. “PHP warns of a new, unlikely code execution flaw, CVE-2026-115560, and advises disabling session upload progress until a fix is released.”

    Security AffairsNews
    PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches

  3. “The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.”

    The Hacker NewsNews
    URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

Indicators reported together

named in the same reports

Also named with it: CVE-2026-109618, CVE-2026-109619

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2026-115560 here?
No account needed. We do not store your IP address.