PHP warns of a third PHP2Shell flaw but won’t rush out a fix

PHP has warned of a third flaw that could let an attacker run code on a web server, two days after its emergency fixes for the PHP2Shell bugs. This time it will not rush out a fix. In a short advisory on 23 October, PHP said the new bug, CVE-2026-115560, needs an unusual mix of […] This story continues at The Next Web