PHP Warns of Unpatched RCE After Emergency Fixes

PHP has warned of a new remote‑code‑execution issue discovered two days after emergency fixes for the critical PHP2Shell flaws were released. The vulnerability, assigned CVE-2026-115560, affects web applications configured in an unusual way and is considered by PHP to be an unlikely risk at present. However, because the flaw can allow an attacker to execute arbitrary code on a server, it raises immediate concerns about online privacy and application security. ¹

The flaw centers around PHP’s “register_user_globals” feature, which lets user input from GET or POST requests become directly accessible within certain scripts. In practice, if an application leaves this setting enabled, data supplied by a client can affect internal variables that control script behavior. This same mechanism was exploited by the earlier PHP2Shell vulnerabilities, where attacker‑controlled data overwrote critical internal variables to gain code execution.

The new CVE follows that pattern but targets only those rare configurations that still enable register_user_globals. ¹

Because the defect exists only when register_user_globals is turned on, PHP does not yet provide an emergency patch; instead, it recommends turning off the feature entirely as a mitigation step. Admins should review their PHP configuration files (php.ini) and ensure that register_user_globals = Off. If they cannot change the setting due to legacy code constraints, they must apply any available updates promptly and monitor for exploitation attempts. Past incidents such as Log4J in late 2021 demonstrate how seemingly obscure flaws can have widespread impact once exploit code becomes public.

Expert analysis notes that while PHP considers the risk low now, the potential for rapid spread remains high because many sites run older PHP versions that may still leave register_user_globals enabled. Disabling the setting strictly controls how external data influences script execution and prevents both the original PHP2Shell issue and the newly identified flaw from being leveraged. As exploit code appears online, patching will become more urgent. This scenario underscores why routine configuration reviews are essential for maintaining privacy and security across web applications.

In summary, organizations running PHP should immediately audit whether register_user_globals is active, disable it if possible, and keep all other components up‑to‑date. The CVE-2026-115560 vulnerability represents an additional vector through which attackers could compromise server integrity, potentially exposing sensitive user data or allowing further lateral movement within networks. Prompt action on these recommendations will reduce the likelihood of successful attacks exploiting this new flaw.