PHP2Shell exploited at a European government entity, Unit 42 says
Within two hours the attackers reached password hashes, MFA secrets, and an NTLM-relay path toward Domain Admin.
86
VulnerabilityPoC ×8
CVE-2026-115560
- CVSS
- —
- EPSS
- —
- Published
- —
- Modified
- —
In the news
6 storiesThird PHP2Shell bug waits for the regular PHP release
CVE-2026-115560 needs a rare session setup; the foundation reports no confirmed compromises of the two bugs patched Wednesday.
72
PHP shares mitigation for unpatched RCE CVE-2026-115560
Only unusual session-handler setups are affected; admins should keep session.upload_progress.enabled set to 0 until the next release.
68
PHP warns of unlikely code-execution flaw CVE-2026-115560
Disable session upload progress until a routine release; the October 21 PHP2Shell patches do not fix it, and no attacks are reported.
64
PHP warns of unpatched RCE in rare session setup (CVE-2026-115560)
Only apps that switch the session serialize handler at runtime and leave upload progress on are exposed; no attacks on this bug are reported.
56
PHP posts informational advisory on session upload progress
The oss-security note only links a PHP.net post and does not state impact, versions, or a fix.
24