PHP warns of a third PHP2Shell flaw but won’t rush out a fix
Comments on “PHP warns of a third PHP2Shell flaw but won’t rush out a fix”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
PHP disclosed a third code-execution flaw, CVE-2026-115560, two days after emergency fixes for the first two PHP2Shell bugs, but will fix it in the next routine release. It requires an unusual setup: the session serialize handler switched to 'php' at runtime and session upload progress enabled. Disabling upload progress is the interim mitigation. CYFIRMA reports low-volume scanning of 216 servers by a suspected North Korea-linked group, while Unit 42 retracted its claim of a confirmed European intrusion. Some NAS vendors, including QNAP, were still working on patches.
Why it ranked
No. 18 of 124 with a score of 0.68. The panel rated it highest on practical relevance (0.77) and reader interest (0.77), lowest on technical depth (0.58). The judges disagreed most on new information (spread 0.48), so the story is marked contested.
Every answer behind this is in the table under Score.
Score
0.68total under rubric v2.2Contestedjudges differ by 0.48 on new information
- Significance0.62
- Reader interest0.77
- Audience breadth0.64
- Practical relevance0.77
- Substantiated0.69
- Technical depth0.58
- New information0.76
- Counts against: Promotional0.03
- Counts against: Overclaim0.17
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.66 | 0.50 | 0.70 | 0.62 | 0.20 | +0.24 | +0.148 |
| Reader interest | 0.68 | 0.72 | 0.90 | 0.77 | 0.22 | +0.26 | +0.199 |
| Audience breadth | 0.61 | 0.60 | 0.72 | 0.64 | 0.12 | +0.13 | +0.084 |
| Practical relevance | 0.75 | 0.75 | 0.82 | 0.77 | 0.07 | +0.22 | +0.170 |
| Substantiated | 0.66 | 0.60 | 0.80 | 0.69 | 0.20 | +0.05 | +0.034 |
| Technical depth | 0.70 | 0.45 | 0.58 | 0.58 | 0.25 | +0.05 | +0.029 |
| New information | 0.79 | 0.50 | 0.98 | 0.76 | 0.48 , above the contested threshold | +0.05 | +0.038 |
| Promotional | 0.05 | 0.03 | 0.02 | 0.03 | 0.03 | −0.19 | −0.006 |
| Overclaim | 0.22 | 0.20 | 0.08 | 0.17 | 0.14 | −0.11 | −0.018 |
| Sum of contributions | +0.678 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.678 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-27/18/"><img src="https://rubric.hrih.si/badge/2026-10-27/18.svg" alt="Ranked #18 on Rubric, 27 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 5 matches source · 3 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceNumber
PHP issued an advisory on 23 October saying the new bug, CVE-2026-115560, requires an application to switch its session serialize handler to 'php' at runtime before starting a session, with session upload progress also enabled.
The cited source says the same thing.
The article says “An application would have to switch its session serialize handler to ‘php’ at runtime before starting a session”
The source says “An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also…”
Source cited by the article: php.net/archive/2026.php
Matches sourceVersion
PHP fixed the first two PHP2Shell flaws on 21 October in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, after researchers using AI reported them.
The cited source says the same thing.
The article says “The fixes are in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35”
The source says “The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two memory-safety bugs, tracked as CVE-2026-109618 and CVE-2026-109619”
Source cited by the article: thenextweb.com/news/php2shell-php-rce-ai-openai-wiz
Matches sourceNumber
CYFIRMA said a Korean-speaking group linked to North Korea is scanning 216 servers for the first two flaws, including government agencies, banks, airports and online transaction platforms.
The cited source says the same thing.
The article says “a Korean-speaking group linked to North Korea is quietly scanning 216 servers for those first two flaws”
The source says “216 hosts that still appear unpatched or only partially mitigated for PHP2Shell (CVE-2026-109618 / CVE-2026-109619”
Source cited by the article: cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure
Matches sourceNumber
CYFIRMA says the operators work from 21 hijacked machines and ties them to North Korea with high confidence, with a moderate-confidence link to the Lazarus Group.
The cited source says the same thing.
The article says “It says the operators work from 21 hijacked machines”
The source says “CYFIRMA continues to assess with HIGH confidence that a North Korean state-nexus threat actor, a Korean-speaking operator assessed to be affiliated with the Lazarus Group ecosystem”
Source cited by the article: cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure
Couldn’t checkQuote
Kumar Ritesh of CYFIRMA said the scanning is deliberately low-volume and paced, with nodes rotated and abandoned at the first sign of blocking, so threshold-based alerting is unlikely to catch it.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The scanning is deliberately low-volume and paced. Nodes are rotated and abandoned at the first sign of blocking or rate-limiting, so threshold-based alerting is unlikely to catch it”
The source says No passage could be compared.
Source cited by the article: thehackernews.com/2026/10/php2shell-exploitation-hits-government.html
Couldn’t checkQuote
Palo Alto Networks' Unit 42 retracted its 23 October update saying attackers had used PHP2Shell against a European government body, saying it could not confirm initial access was tied to the PHP2Shell CVEs.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23”
The source says No passage could be compared.
Source cited by the article: unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619
Matches sourceNumber
Cloudflare has reported exploit attempts against PHP2Shell running into the millions.
The cited source says the same thing.
The article says “Attempts still run into the millions, as Cloudflare has reported”
The source says “Cloudflare has recorded millions of attempts to exploit two critical PHP vulnerabilities since details became public on Wednesday, according to CEO Matthew Prince”
Source cited by the article: thenextweb.com/news/cloudflare-php2shell-millions-exploit-attempts
Couldn’t checkDate
Synology has shipped updated PHP packages, while QNAP is still working on fixes with no date given.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Synology has shipped updated PHP packages, AppleInsider reported on 22 October”
The source says No passage could be compared.
Source cited by the article: appleinsider.com/articles/26/10/22/critical-php-vulnerabilities-threaten-your-nas-not-every-vendor-has-a-fix
Also covered by
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 27 Oct 2026, 05:46 UTC. It played no part in the ranking.