From The Next Web · Ana Maria Constantin · · 1m 40s
PHP finds third flaw, skips emergency fix
PHP warns of a third code-execution bug in its web language, but will not rush a patch. Meanwhile, a North Korean-linked group scans for the first two flaws.
In brief
PHP warns of a third code-execution bug in its web language, but will not rush a patch. Meanwhile, a North Korean-linked group scans for the first two flaws. PHP disclosed a third vulnerability allowing remote code execution on October twenty-third but declined to issue an emergency fix, instead recommending a…
Third PHP flaw found, no rush to fix
PHP warned on October twenty-third of CVE-2026-115560, a third vulnerability allowing attackers to run code on web servers. Unlike the first two flaws, PHP will not issue an emergency patch.
The flaw needs an unusual setup
The bug requires an application to switch its session serialize handler to 'php' at runtime before starting a session, and session upload progress must be enabled.PHP says this setup is not expected in practical use.
Workaround available now
PHP recommends turning off session upload progress until the next routine release carries the fix.Elizabeth Barron, the PHP Foundation's executive director, told The Register that admins who already applied this setting need do nothing more.
North Korea-linked group scans targets
A Korean-speaking group linked to North Korea is quietly scanning two hundred sixteen servers for the first two PHP flaws, CYFIRMA reported on October twenty-third.
Scanning is deliberate and careful
The operators work from twenty-one hijacked machines and rotate nodes at the first sign of blocking or rate-limiting.
“The scanning is deliberately low-volume and paced. Nodes are rotated and abandoned at the first sign of blocking or rate-limiting, so threshold-based alerting is unlikely to catch it.”
No confirmed break-ins yet
Palo Alto Networks' Unit forty-two retracted a claim on October twenty-third that attackers had used PHP2Shell against a European government body.As of Friday, nobody had publicly confirmed a successful break-in through PHP2Shell.
“We currently have no evidence of any exploitation of these vulnerabilities on patched PHP versions.”
The takeaway
PHP disclosed a third vulnerability allowing remote code execution on October twenty-third but declined to issue an emergency fix, instead recommending a workaround until the next routine release.
