PHP has warned of a third flaw that could let an attacker run code on a web server, two days after its emergency fixes for the PHP2Shell bugs. This time it will not rush out a fix.
In a short advisory on 23 October, PHP said the new bug, CVE-2026-115560, needs an unusual mix of settings and application code. An application would have to switch its session serialize handler to ‘php’ at runtime before starting a session. Session upload progress would also have to be on.
Until the next routine release, which will carry the fix, PHP suggests turning off session upload progress. That setting was already a fallback for one of the first two flaws, so admins who applied it need do nothing more. Elizabeth Barron, the PHP Foundation’s executive director, told The Register that the foundation does not expect that setup in practical use.
PHP fixed the first two flaws on 21 October, after researchers using AI reported them. The fixes are in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Scanning linked to North Korea
Meanwhile, a Korean-speaking group linked to North Korea is quietly scanning 216 servers for those first two flaws, CYFIRMA said. The threat intelligence firm says the targets include government agencies, banks, airports and online transaction platforms. They sit in the US, Japan, South Korea, India, Australia, the EU and elsewhere.
CYFIRMA published its advisory on 23 October and updated it on 24 October. It says the operators work from 21 hijacked machines. It has not confirmed any mass compromise by this group. Its founder and chief executive, Kumar Ritesh, described the method to The Hacker News.
“The scanning is deliberately low-volume and paced. Nodes are rotated and abandoned at the first sign of blocking or rate-limiting, so threshold-based alerting is unlikely to catch it.” Kumar Ritesh, CYFIRMA, to The Hacker News
The firm ties the operators to North Korea with high confidence. It points to their language, their talk in a closed I2P channel and their targets. It rates their link to the Lazarus Group at moderate confidence. Next, the advisory says, the operators will pick the most promising hosts and decide which public methods are worth adapting.
A claim withdrawn
A separate report no longer stands. On 23 October, Palo Alto Networks’ Unit 42 said attackers had used PHP2Shell against a government body in Europe. Within two hours, it said, they reached password hashes and multi-factor authentication secrets. It saw signs that an AI agent was doing the work.
On Sunday, Unit 42 retracted that update.
“We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23.” Unit 42, Palo Alto Networks
Attempts still run into the millions, as Cloudflare has reported. Officials in Germany and Japan had already said they saw no confirmed break-ins. As of Friday, nobody had publicly confirmed a successful break-in through PHP2Shell, The Register reported. Barron said this of the first two flaws:
“We currently have no evidence of any exploitation of these vulnerabilities on patched PHP versions.” Elizabeth Barron, to The Register
Storage boxes still waiting
The flaws also reach network storage devices, which run PHP in their own software. Synology has shipped updated PHP packages, AppleInsider reported on 22 October. QNAP confirmed a range of affected products and was still working on fixes, with no date given. It reported no attacks on its products. TerraMaster said it was working toward a fix.