URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

PHP has issued a warning about a new remote code execution vulnerability, just two days after releasing emergency patches for the PHP2Shell flaws. This new issue, identified as CVE-2026-115560, poses a risk to web applications with a specific unusual configuration. PHP views this vulnerability as an unlikely risk. The project does not plan to release an emergency fix for this issue. Instead, PHP recommends disabling a particular feature to mitigate the risk. The vulnerability only affects web applications with this unique configuration.