Blog
Vulnerabiltiy Advisory
CVE-2026-115560: PHP's New Unpatched RCE, and the Exposure Window Just Got Longer
Two days after the PHP2Shell emergency patches, PHP disclosed CVE-2026-115560, a remote code execution flaw with no patch yet. It is narrower, but it proves a point: the next PHP flaw will not wait for your patch cycle.
PHP
PHP2Shell: Patch Now, Then Close the Exposure Window
Two critical PHP flaws allow unauthenticated remote code execution on most PHP servers. Here is what to patch, what to do if you can't patch today, and where a preemptive WAF fits.