PHP Warns of New Remote Code Execution Vulnerability CVE-2026-115560

The PHP security team has issued a warning about a new remote code execution vulnerability, tracked as CVE-2026-115560, just two days after deploying emergency fixes for the PHP2Shell class of flaws. According to the advisory, the vulnerability affects only web applications configured in an unusual way. The project has assessed the risk as unlikely for typical deployments and has not released an emergency patch. Instead, PHP recommends that server administrators disable the specific feature implicated in the flaw as a mitigation measure. No confirmed exploitation of CVE-2026-115560 in the wild has been reported at the time of disclosure. The CVE was assigned following the initial report, but full advisory details are pending release. The timing of the disclosure has raised attention, as it follows closely on the heels of the PHP2Shell emergency patches, which addressed critical RCE vectors in the PHP CGI component.