[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-php-flags-third-php2shell-bug-skips-the-emergency-fix":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12391,"php-flags-third-php2shell-bug-skips-the-emergency-fix","PHP Flags Third PHP2Shell Bug, Skips the Emergency Fix","PHP disclosed CVE-2026-115560, a code-execution flaw, two days after its emergency patches, and this time it is not rushing out a fix.","PHP has disclosed a third flaw in the PHP2Shell family, and unlike the first two, it will not get an emergency patch.\n\nThe PHP project published a short advisory on October 23 for CVE-2026-115560. The bug could let an attacker run code on a web server, meaning they could make the machine carry out commands of their choosing. The advisory landed two days after PHP shipped emergency fixes for the earlier PHP2Shell bugs. PHP said it would not rush out a fix this time.\n\nThe reason, according to the advisory, is how hard the flaw is to use. The bug needs an unusual mix of things to line up before an attacker can exploit it. That is a different profile from the first two flaws, which PHP judged serious enough to patch on an emergency schedule.\n\nThe split matters for anyone running PHP, which powers a large share of the web. Remote code execution is the worst class of server bug, but severity in practice depends on how many servers meet the conditions an attacker needs. A flaw that works only in rare setups is a smaller target than one that works almost everywhere. Maintainers weigh that trade-off whenever they decide between an emergency release and waiting.\n\nPHP has treated the first two flaws as emergencies and this one as something less urgent, and the advisory's explanation of the bug's unusual requirements is the whole basis for that call.","[\"php\",\"php2shell\",\"vulnerability\",\"web-security\"]","2026-10-26T11:25:07.000Z","2026-11-07T23:55:03.117Z","2026-11-07T23:55:05.325Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the line 'the full list of those circumstances is not spelled out in the material we reviewed', which is meta-text admitting missing source material, and cut or source the unsupported claim that a fix 'could still be weeks away' and the closing speculation built on it, so the piece ends on a finished, supported concluding line.","resolved","security",[32,33,34,35],"php","php2shell","vulnerability","web-security",[37],{"name":38,"url":39},"The Next Web","https:\u002F\u002Fthenextweb.com\u002Fnews\u002Fphp2shell-third-flaw-php-no-emergency-fix",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7110,"2026-11-08T14:34:09.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1099,"2026-11-08T15:24:01.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Deals","deals",620,"2026-11-08T08:00:00.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Policy","policy",604,"2026-11-07T15:48:26.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Consumer Tech","consumer-tech",336,"2026-11-08T21:00:00.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Hardware","hardware",316,"2026-11-08T14:36:39.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",222,"2026-11-07T16:19:17.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Software","software",154,"2026-11-08T15:42:52.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Startups","startups",150,"2026-11-06T16:50:01.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",125,"2026-11-06T22:15:59.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",111,"2026-11-08T21:27:29.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",94,"2026-11-08T20:52:05.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]