PHP has warned of another possible route to remote code execution on web servers, just two days after issuing emergency fixes for the critical PHP2Shell vulnerabilities. According to the project, the newly identified issue affects only web applications configured in an unusual way, and PHP has described the risk as unlikely. At the time of the announcement, the project was not issuing an emergency patch for this separate issue and instead recommended disabling a specific feature where relevant.

What happened

The newly disclosed issue has been assigned CVE-2026-115560. PHP said the flaw could allow an attacker to execute code on a server, but only under particular configuration conditions. Based on the source report, PHP does not currently view this as requiring the same emergency response as the earlier PHP2Shell flaws.

Importantly, this is a different issue from the vulnerabilities that were patched in the emergency PHP2Shell update. The available information suggests that businesses should treat it as a configuration-linked security risk rather than assume that all PHP deployments are broadly exposed.

Why it matters for European businesses

PHP remains widely used across business websites, customer portals, content management systems, e-commerce stores and internal web applications. Even when a newly disclosed issue is described as low likelihood, it can still matter for organisations that run custom hosting setups, legacy applications or complex server configurations.

For European businesses, the practical concern is not only whether the flaw is exploitable in theory, but whether their own infrastructure includes the affected configuration. Companies that rely on external developers, agencies, managed hosting providers or older PHP-based applications may not always have immediate visibility into this.

The disclosure is also a reminder that security risk can persist even after emergency patching. When a major platform releases urgent fixes, IT teams should verify not only that updates have been applied, but also whether related hardening guidance or configuration changes are needed.

Who may be affected

• Businesses running PHP-based websites, especially custom-built or self-hosted applications
• E-commerce companies using PHP-dependent storefronts, plugins or backend systems
• IT teams and hosting administrators responsible for web server configuration and PHP runtime settings
• Digital agencies and developers maintaining client websites on shared or managed infrastructure
• Companies with legacy web systems where unusual or outdated configurations may still be in use

What companies should consider

• Confirm whether emergency updates for the earlier PHP2Shell vulnerabilities have already been applied.
• Review PHP configuration to determine whether the newly mentioned attack path is relevant in your environment.
• Check PHP project guidance on the feature it recommends disabling, and assess whether turning it off would affect application functionality.
• Prioritise an audit of internet-facing PHP applications, especially older custom systems and e-commerce environments.
• Ask hosting providers, development partners or internal IT teams for written confirmation on exposure, mitigation status and any required configuration changes.
• Monitor for further updates from the PHP project, since disclosure details and mitigation advice may evolve.

At this stage, the reported issue appears narrower than the earlier PHP2Shell vulnerabilities. Still, organisations using PHP in production should treat the disclosure as a prompt to review server configuration and hardening rather than assuming that patching alone has fully addressed current risk.