PHP has disclosed a third flaw in the PHP2Shell family, and unlike the first two, it will not get an emergency patch.
The PHP project published a short advisory on October 23 for CVE-2026-115560. The bug could let an attacker run code on a web server, meaning they could make the machine carry out commands of their choosing. The advisory landed two days after PHP shipped emergency fixes for the earlier PHP2Shell bugs. PHP said it would not rush out a fix this time.
The reason, according to the advisory, is how hard the flaw is to use. The bug needs an unusual mix of things to line up before an attacker can exploit it. That is a different profile from the first two flaws, which PHP judged serious enough to patch on an emergency schedule.
The split matters for anyone running PHP, which powers a large share of the web. Remote code execution is the worst class of server bug, but severity in practice depends on how many servers meet the conditions an attacker needs. A flaw that works only in rare setups is a smaller target than one that works almost everywhere. Maintainers weigh that trade-off whenever they decide between an emergency release and waiting.
PHP has treated the first two flaws as emergencies and this one as something less urgent, and the advisory's explanation of the bug's unusual requirements is the whole basis for that call.