PHP Discloses Low-Risk RCE Variant, Will Not Issue Emergency Fix
PHP has identified a new code-execution vulnerability, CVE-2026-115560, that only affects web applications with an unusual configuration. The project considers exploitation unlikely and is not releasing an emergency patch, instead advising administrators to disable a specific feature.
The PHP project has disclosed a code-execution vulnerability, CVE-2026-115560, while characterizing its risk as low because it applies only to web applications set up in an unusual way. The project does not plan an emergency release; its guidance is for administrators to turn off a specific feature. The episode illustrates how vulnerability severity can depend on deployment choices, and how projects may weigh limited exploitation likelihood against the disruption of urgent patching.
Organizations running PHP-based web applications could be affected only where the unusual configuration is present, so exposure may be concentrated among a limited set of administrators. Because exploitation is considered unlikely and no emergency fix is planned, many teams may treat the issue as routine maintenance rather than urgent incident response. Still, those who rely on the affected feature may need to assess whether disabling it disrupts services, making configuration review and patch planning important.