Impacted if
Not known yet — the vendor's record and the NVD are being read.
First seen by AX-NEWS · latest story . Severity: NVD, or the CVE record while the NVD has not scored it. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Coverage
-
URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
The Hacker News
Cybersecurity
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an…
-
Cloudflare deploys protections against php2shell vulnerability
Cloudflare Blog
Cloud & Infrastructure
Update - On October 23, the PHP project published an informational advisory for a related vulnerability, CVE-2026-115560, in PHP's session upload progress feature. It affects fully patched PHP releases, including 8.5.12, and will be fixed…