PHP warns of a third PHP2Shell flaw but won’t rush out a fix

PHP disclosed a third code-execution flaw, CVE-2026-115560, two days after emergency fixes for the first two PHP2Shell bugs, but will fix it in the next routine release. It requires an unusual setup: the session serialize handler switched to 'php' at runtime and session upload progress enabled. Disabling upload progress is the interim mitigation. CYFIRMA reports low-volume scanning of 216 servers by a suspected North Korea-linked group, while Unit 42 retracted its claim of a confirmed European intrusion. Some NAS vendors, including QNAP, were still working on patches.