PHP Issues New Remote Code Execution Advisory After Recent Emergency Patch

The PHP development team has issued a fresh security advisory warning of a remote code execution (RCE) vulnerability that could allow attackers to execute arbitrary commands on vulnerable web servers. The flaw, catalogued as CVE-2026-115560, was disclosed only two days after the community received emergency patches for the earlier PHP2Shell vulnerabilities, raising concerns about the rapid succession of critical issues affecting the widely used scripting language.

CVE-2026-115560 is distinct in that it impacts only web applications that employ a rare configuration setting, specifically those that enable the "allow_url_include" directive while also using certain legacy input handling functions. In such an environment, a crafted request can trigger the inclusion of remote code, bypassing typical safeguards. PHP’s security team stresses that the vulnerability is unlikely to affect the majority of installations, but advises administrators to verify their configuration files promptly.

The timing of this advisory follows the emergency release of patches for PHP2Shell, a series of flaws that permitted unauthenticated attackers to gain shell access on vulnerable servers. Those patches were rolled out after coordinated disclosure with security researchers, and many hosting providers applied them within days. The emergence of a new RCE vector so soon after highlights the ongoing challenges of maintaining the security of a language that powers a substantial portion of the web.

Security experts recommend that site operators review their php.ini settings, particularly the status of "allow_url_include" and related directives such as "allow_url_fopen." Disabling these options, or ensuring they are set to false, eliminates the attack surface presented by CVE-2026-115560. For environments that require the functionality, developers are urged to adopt alternative, safer methods for fetching remote resources, such as using cURL with strict validation. The PHP team has indicated that a future release will address the issue more comprehensively, though a specific timeline has not been provided.

While the vulnerability’s narrow scope limits its immediate impact, the rapid cadence of disclosures serves as a reminder for administrators to maintain vigilant update practices and to audit server configurations regularly. As PHP continues to evolve, balancing feature richness with robust security controls remains a central concern for both the core developers and the broader ecosystem that depends on the language for critical web applications.