Php issued a warning on 23 October 2026 regarding a third PHP2Shell flaw that could let hackers run arbitrary code on a web server, according to The Next Web. This advisory came just two days after emergency patches for earlier bugs, but developers chose to wait for the next routine release rather than push an emergency fix.
Key takeaways
- Php reported a new bug, CVE-2026-115560, requiring a specific mix of settings and custom application code.
- CYFIRMA tracked a Korean-speaking group quietly scanning 216 servers across multiple global regions.
- Palo Alto Networks Unit 42 retracted an earlier claim that attackers had breached a European government body using the bugs.
- Storage device makers such as Synology, QNAP, and TerraMaster responded with updates or active work on patches.
What is the third PHP2Shell flaw and why is there no emergency patch?
The new bug requires an unusual combination of settings before an attacker can exploit it. An application must switch its session serialize handler to php at runtime right before starting a session, and session upload progress must remain active. Elizabeth Barron, executive director of the PHP Foundation, stated that this setup is not expected in practical use.
Because of these strict prerequisites, the foundation decided against an emergency patch. Instead, admins are advised to turn off session upload progress until the next routine release carries the official fix. Since that setting already acted as a fallback for the first two issues, administrators who already adjusted it need take no further action.
Which servers are targeted by scanning groups?
CYFIRMA reported that a Korean-speaking group linked to North Korea is actively scanning 216 servers for the initial two PHP2Shell flaw vulnerabilities. The targets span government agencies, banks, airports, and online transaction platforms located in the United States, Japan, South Korea, India, Australia, and the European Union. Researchers noted that the scanning activity remains low-volume and rotates nodes frequently to avoid detection thresholds.
Meanwhile, reports of actual breaches faced setbacks when Palo Alto Networks Unit 42 retracted a claim that attackers used the vulnerabilities against a European government body. Cloudflare noted that attempts still run into the millions, yet officials in Germany and Japan confirmed no break-ins. Storage hardware makers like Synology shipped updated software packages, while QNAP and TerraMaster continue working on fixes for their own systems.
What this means for server administrators
Network administrators managing web servers and storage appliances must keep a close eye on their software versions and configuration settings. While the latest vulnerability requires a rare mix of parameters, the ongoing scanning activity shows that threat actors continue to probe infrastructure worldwide. Organizations running affected network storage units must watch for vendor updates from brands like QNAP and TerraMaster, as hardware vendors work to integrate necessary software updates into their proprietary operating systems.
Frequently asked questions
CVE-2026-115560 is a third flaw announced by PHP on 23 October 2026 that could permit code execution on a web server under very specific runtime settings.
PHP decided against an emergency patch because the vulnerability requires an unusual configuration mix, including runtime session handler changes, which the PHP Foundation does not expect in practical use.
CYFIRMA reported that a Korean-speaking group linked to North Korea is quietly scanning 216 servers across multiple countries for the first two vulnerabilities.
No. Palo Alto Networks Unit 42 retracted its earlier claim that attackers had used the vulnerabilities to breach a European government body, stating they could not confirm the initial access was associated with the CVEs.
Storage devices run PHP in their own software. Synology shipped updated packages, while QNAP and TerraMaster stated they were working on fixes for affected products without giving specific release dates.
Based on reporting by The Next Web. Read the original article
