Just two days after the emergency PHP2Shell patches, the PHP project published another security warning on October 23, 2026. This one is tracked as CVE-2026-115560, and if you’ve been following the news, your first reaction might be “here we go again.”

Take a breath. This PHP security warning is real, but it’s a very different situation from PHP2Shell. Here’s what changed, how worried you should be, and the one server setting to ask your host or developer about this week.

What does the new PHP security warning say?

On October 21, PHP released emergency updates (8.5.12, 8.4.27, 8.3.36 and 8.2.35) for two critical flaws known as PHP2Shell. We covered that in our PHP2Shell guide for business owners.

Two days later, PHP posted an informational notice about a separate issue, CVE-2026-115560. According to The Hacker News, PHP is not issuing an emergency release this time. The fix will arrive in the next routine bugfix release, along with a full advisory.

“The issue can only occur under an unusual combination of configuration and application code.”PHP advisory, as reported by SecurityOnline

How is this different from PHP2Shell?

PHP2Shell was dangerous because almost any PHP site could be exposed, even a simple, well-built one. This new flaw needs several specific things to line up at the same time.

IT-Connect notes that PHP’s default configuration isn’t affected, because the risky setup only happens when an application changes a session setting while it runs. As of this writing, no exploitation or public attack code has been reported for this new flaw (Astra Security).

Why it still matters for small businesses

“Unlikely” isn’t the same as “impossible.” Many small-business websites run on plugins, themes and custom code that the owner has never looked under the hood of. You probably don’t know whether something on your site changes session settings, and you shouldn’t have to.

That’s why the safe move is simple: switch off the feature this flaw depends on. Session upload progress is a little-used PHP feature that powers upload progress bars. Most business websites never use it. PHP itself suggests it “may be prudent” to turn it off if you don’t need it, even after the fix ships, because attackers are paying closer attention to this part of PHP (IT-Connect).

There’s also a bigger lesson here. Once a major flaw is found, researchers and attackers dig into the same area looking for more. Follow-up warnings like this one are common, which is why ongoing website maintenance matters more than any one-time fix.

Who needs to make the change?

Just like the PHP2Shell update, this is a server setting, not a WordPress setting. Clicking “Update” in your WordPress dashboard won’t change it.

• Shared or managed hosting: your hosting company controls this setting. Ask them to confirm it’s off.
• VPS or dedicated server: your host or developer sets it in the PHP configuration and restarts PHP.
• Agency-managed site: your agency should confirm both the patch and the setting for you.

4 steps to take this week

1. Confirm the PHP2Shell patch is in.
   Make sure your server runs PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. In WordPress, check Tools → Site Health → Info → Server.
2. Ask your host to turn off session upload progress.
   Send this: “Please set session.upload_progress.enabled to 0 for my site’s PHP and confirm it’s applied.”
3. Make sure it’s set at the server level.
   Security researchers recommend setting it in the main PHP configuration and restarting PHP, not relying on a site-level file (Astra Security).
4. Watch for PHP’s next regular release.
   When it ships, plan to update again, and keep the setting off unless your site actually needs upload progress bars.

Frequently asked questions

The bottom line

This second PHP security warning is lower risk than PHP2Shell, but it’s easy to close. Confirm your server has the October 21 update, turn off session upload progress, and plan for one more PHP update when the next release lands.