The PHP project will not rush out a fix for a third flaw that could let attackers run code on web servers, and Mandiant's chief technology officer said exploitation of the two critical PHP2Shell bugs patched this week may already have begun on a small scale, The Register reported Friday. For organizations, the episode is shifting from a sprint to patch toward a longer problem: a serious warning from a major incident responder, still no confirmed compromise, and tens of millions of servers that may never be updated.
The Primary Wire reported Friday morning that the Netherlands' cyber agency had judged the flaws harder to exploit than first feared. New since then: the PHP Foundation's reasoning for skipping an emergency patch, Mandiant's assessment and fresh counts of unpatched systems.
What Happened
PHP's informational advisory reserves CVE-2026-115560 for a bug in session upload progress, a feature that reports how far a file upload has gotten. PHP says it can occur only under "an unusual combination of configuration and application code." An application must set the session serializer, the component that converts session data into storable text, to php_binary or php_serialize in its configuration and then switch it to php while running, before a session starts, with upload progress still enabled. Applications that never change that setting at runtime are not affected.
PHP will fix the bug in its next regular release and has given no version or date, so the 8.5.12, 8.4.27, 8.3.36 and 8.2.35 releases of Oct. 21 do not cover it. Until then it recommends setting session.upload_progress.enabled=0. That is the same setting PHP listed Oct. 21 as a stopgap for CVE-2026-109619, one of the two PHP2Shell flaws, and sites that applied it then need do nothing more.
Elizabeth Barron, executive director of the PHP Foundation, told The Register the combination required is very unlikely in practice, which is why there is no emergency release. She said the foundation has no evidence the two original flaws were exploited successfully before disclosure or on patched versions, and that it is working with OpenAI, Wiz and Calif, the groups that found them.
Charles Carmakal, Mandiant's chief technology officer, struck a more cautious note in a LinkedIn post cited by The Register and Cybersecurity Dive: "exploitation may have already begun in a limited fashion, and the threat is viable and very serious." He said there was no evidence of successful widescale exploitation and that many public exploits appear "vibe-coded," a term for code produced quickly with AI tools, and cannot run commands on a target. But Mandiant validated some that can, against default setups of mod_php, where PHP runs inside the Apache web server, though not PHP-FPM, where PHP runs as a separate service. The Register noted that Google owns both Mandiant and Wiz.
Why It Matters
The exposure is wide and slow to shrink. Censys data cited by The Record shows more than 41 million internet-facing PHP services on affected versions as of Oct. 22, against about 1 million on fixed releases. Data from security vendor Qualys, drawn from its customers and cited by SecurityWeek, puts about 110 million PHP instances, or 71%, on end-of-life versions, most of which will never receive a patch.
Carmakal's warning comes from a firm that responds to breaches, and leaders deciding how long to keep emergency measures in place should weigh it against the absence of confirmed compromises. Mandiant's advice, per Cybersecurity Dive, goes beyond upgrading: restart web services, rotate keys and passwords on internet-facing systems that were exposed before patching, and watch for unusual traffic.
Attackers are active. Sophos said it blocked an attempt to install malware it believes is a variant of Mirai, code that hijacks devices for botnets, and retracted an earlier report of a successful exploit, SecurityWeek reported. Hunt.io reported no confirmed compromises.
What to Watch
- The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog did not list either PHP2Shell flaw as of Friday. A listing would signal confirmed exploitation and set a federal patch deadline.
- Palo Alto Networks' advisory estimates PAN-OS firewall hotfixes from Oct. 26 to Oct. 30. It does not report any as released and says the company knows of no malicious exploitation against its products. Its latest update lists WildFire WF-500 appliances as unaffected.
- PHP's next regular release, which should carry the CVE-2026-115560 fix and a full advisory.
- Any first confirmed compromise.
