Friday, October 23, 2026 · 1 of 5

1. PHP warns of a third RCE, CVE-2026-115560, two days after the PHP2Shell emergency release

   In a narrow session configuration, with no fix until the next routine release. Set one ini value now.

   Oct 23Security