PHP Foundation Warns of Third PHP2Shell Vulnerability

The PHP Foundation has issued a security advisory for CVE-2026-115560, the third vulnerability in the PHP2Shell series that allows remote code execution on web servers. While the foundation released emergency patches for the first two flaws on October 21, it will not rush a fix for this third bug because it requires an unusual combination of application code and runtime settings. Administrators are advised to disable session upload progress until a routine release is available.

Threat intelligence firm CYFIRMA reports that a Korean-speaking group linked to North Korea is scanning servers across the United States, Japan, South Korea, India, Australia, and the European Union. The targets include government agencies, airports, and banks. The scanning is described as low-volume and paced to avoid threshold-based alerting, with nodes being abandoned at the first sign of rate-limiting.

Hardware providers including Synology, QNAP, and TerraMaster are currently addressing the flaws in their software, with Synology already shipping updates. Although Palo Alto Networks previously claimed the vulnerabilities were used against a European government body, the firm has since retracted that statement. No successful exploitations of the PHP2Shell vulnerabilities have been publicly confirmed.