Patched PHP isn't the end of it: a new flaw, hidden copies and leaked memory

New Zealand businesses that rushed to update PHP after this week's PHP2Shell disclosure have another problem. A related flaw, CVE-2026-115560, affects fully patched releases including PHP 8.5.12, according to Cloudflare. It won't be fixed until PHP's next regular release.

Cloudflare updated its blog to say the PHP project published an informational advisory for the flaw on 23 October. The bug is in PHP's session upload-progress feature. Cloudflare is the only source here for the advisory, and the details below are its account.

That feature has been in PHP since version 5.4.0 and is switched on by default, according to Recorded Future, citing VirusTotal. Recorded Future says some ways of exploiting the original PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, also run through it.

Cloudflare says its web application firewall (WAF) protects all customers against known exploit attempts, but only if their site uses PHP's default name for the upload-progress field. Sites that changed the session.upload_progress.name setting aren't covered by the rule. Cloudflare also says it has seen attackers changing their attack code to try to get past its protections.

Changing a setting won't close the gap. According to watchTowr, PHP says no configuration change fully mitigates these vulnerabilities.

Copies of PHP nobody thinks about

The NCSC's updated alert takes the problem beyond the web server. It says some implementations of PHP, including firewalls, edge devices and other embedded platforms, may need their own assessment and fixes, with updates applied according to each vendor's guidance.

Updating PHP on a website does nothing for a copy built into a firewall. Many small businesses don't know which of their devices run PHP. The supplier should, and it's the supplier who has to ship the fix.

Patching doesn't evict anyone

The NCSC urges affected organisations to investigate whether anyone has gained unauthorised access to the affected products.

The NZ IT firm NSP explains why that matters. It says researchers at Wiz showed an attacker could read the memory of the PHP process, including passwords, tokens and API keys from other visitors' requests, without running any code. NSP says this leaves very little trace from the outside.

NSP also says Amazon Threat Intelligence reported a PHP2Shell exploitation attempt on 17 October, four days before public disclosure. A server patched on the first day could still have leaked credentials in the days before. Any passwords or keys that passed through an exposed server in that time should be treated as compromised.

None of the sources reports a confirmed compromise of a New Zealand organisation.

What the fix actually involves

Cloudflare says updating website code or plugins alone does nothing, because the flaws are in PHP itself. If a hosting provider manages PHP, the customer has to ask the provider to apply the update.

watchTowr's advice is to restart every PHP worker after updating so the fix takes effect. Any PHP system that can't be updated straight away should have its internet access restricted. watchTowr says PHP rates the risk highest for sites running PHP through Apache's mod_php, where an attack can succeed before any of the site's own code has run.

Older sites are worse off. watchTowr says PHP 7.4, 8.0 and 8.1 have no official fixed release. Their owners need a package from their Linux distribution or a long-term-support vendor, or PHP's minimal source patches. PHP 7.3 and older, including PHP 5, have no fix at all.

Whose job is it?

For many SMEs, nobody is sure. NSP says the website often sits outside the IT arrangement. Marketing commissions it, an agency builds it, and the IT provider looks after laptops, email and the network. The web server can fall between them.

NSP relays advice from Insurance Business NZ: find out who manages PHP on your website and get written confirmation that it has been updated. For a business with cyber insurance, that paper trail could matter if it ever makes a claim.

The new flaw complicates that confirmation. A provider can truthfully say PHP is on the latest release. Going by Cloudflare's account, that release is still exposed to CVE-2026-115560 until PHP ships its next regular update.