PHP has disclosed CVE-2026-115560, a new remote code execution risk affecting web applications that use an unusual combination of PHP session configuration and runtime behavior. The issue was disclosed on October 23, 2026, only two days after PHP released emergency fixes for the critical PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.
Are IC2 and/or other devices affected?