← All stories

Breaches & incidents

PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches

By Security Affairs1 min read

PHP has warned of a new code execution vulnerability, tracked as CVE-2026-115560, only days after shipping emergency patches for the critical PHP2Shell flaws, Security Affairs reports. Users are advised to disable session upload progress until an official fix is available.

Cover for a breaches story

PHP has warned of a new code execution vulnerability just days after releasing emergency patches for the critical PHP2Shell flaws, according to a report by Security Affairs.

The newly disclosed issue is tracked as CVE-2026-115560. According to the source, PHP describes the flaw as unlikely to be exploited, because it affects only a specific PHP configuration rather than default or common setups. Even so, the project has issued a precautionary recommendation: users should disable the session upload progress feature until an official fix is released. Session upload progress is a PHP feature that allows applications to monitor the state of file uploads, and the advisory indicates that turning it off removes exposure to the flaw in the meantime.

The timing of the disclosure is notable. As reported by Security Affairs, the warning arrived only two days after PHP shipped emergency patches addressing the PHP2Shell vulnerabilities, which were treated as critical. The back-to-back advisories mean administrators running PHP may face a second round of mitigation work in the same week, first applying the PHP2Shell fixes and now adjusting configurations to address CVE-2026-115560.

The source report does not provide further technical details on the vulnerability, such as the precise configuration required for exploitation, the list of affected PHP versions, or a confirmed release date for the forthcoming patch. Security Affairs notes that the information available comes from PHP's own warning, and that administrators should watch for the official fix while applying the recommended workaround in the interim.

Source: Security Affairs

Cover for a breaches story

Breaches & incidents

Cyberattack on Italy's Chamber of Deputies Highlights Hybrid Warfare Risks

A cyberattack targeted email accounts at Italy's Chamber of Deputies, including a parliamentary account assigned to Prime Minister Giorgia Meloni, Security Affairs reports. The outlet says the incident raises broader questions about hybrid warfare, transparency, and the defenses of European democratic institutions.

1 min read

AI-written summary Source: Security Affairs · Fetched

Cover for a breaches story

Breaches & incidents

Magento Skimmer Campaign Infects 953 Online Stores Across Five Domains

A criminal group has infected 953 online stores, most of them running Magento, in a web skimming campaign active since July 2025, according to Sansec researchers cited by Security Affairs. The attackers hide malicious code in CMS blocks and use five domains and bot filtering to evade detection.

1 min read

AI-written summary Source: Security Affairs · Fetched

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.