AustraliaGrant Stevens leaves SA Police after 44 years Hacking DeskPHP flags new flaw CVE-2026-115560 after PHP2Shell AmplifiedAnberlin — Never Take Friendship Personal The WireTyphoon Champi shuts Taiwan, 1 dead and 350 injured AI DeskGrok Bot can now use your phone's Calendar and Contacts AmplifiedEmery — The Question SpaceX DeskSpaceX seeks 80,000 cell sites as carriers lobby the FCC Tesla DeskTesla on FSD hits and kills man crossing I-80 in Vallejo AmplifiedDemon Hunter — Summer of Darkness Tesla DeskTesla Q3 explained: merger jitters, robotaxis and cash Computing DeskSupermicro packs 256 NVIDIA Vera CPUs into one rack AmplifiedNorma Jean — Bless the Martyr and Kiss the Child Game ReviewsModern Warfare 4 launches today without Game Pass Film DeskFinal Fantasy Resonance reviews: great fights, weak story Coming SoonPhantom Blade Zero launch trailer lands before 29 October BreakingMagnitude 7 quake in Tibet kills 16, injures 76 EV DeskGM leads US$108m round for sodium-ion maker Peak Energy Roads DeskWA puts a horror villain in the back seat to fight fatigue Video DeskIdris Elba sinks under the sea in Above the Below trailer How-to DeskHow to check a supplier's new bank details before you pay

AustraliaGrant Stevens leaves SA Police after 44 years Hacking DeskPHP flags new flaw CVE-2026-115560 after PHP2Shell AmplifiedAnberlin — Never Take Friendship Personal The WireTyphoon Champi shuts Taiwan, 1 dead and 350 injured AI DeskGrok Bot can now use your phone's Calendar and Contacts AmplifiedEmery — The Question SpaceX DeskSpaceX seeks 80,000 cell sites as carriers lobby the FCC Tesla DeskTesla on FSD hits and kills man crossing I-80 in Vallejo AmplifiedDemon Hunter — Summer of Darkness Tesla DeskTesla Q3 explained: merger jitters, robotaxis and cash Computing DeskSupermicro packs 256 NVIDIA Vera CPUs into one rack AmplifiedNorma Jean — Bless the Martyr and Kiss the Child Game ReviewsModern Warfare 4 launches today without Game Pass Film DeskFinal Fantasy Resonance reviews: great fights, weak story Coming SoonPhantom Blade Zero launch trailer lands before 29 October BreakingMagnitude 7 quake in Tibet kills 16, injures 76 EV DeskGM leads US$108m round for sodium-ion maker Peak Energy Roads DeskWA puts a horror villain in the back seat to fight fatigue Video DeskIdris Elba sinks under the sea in Above the Below trailer How-to DeskHow to check a supplier's new bank details before you pay

Saturday 24 October 2026

PHP flags new flaw CVE-2026-115560 after PHP2Shell

PHP says set session.upload_progress.enabled=0 to block CVE-2026-115560, a new and unlikely RCE path. It follows the PHP2Shell fixes of 21 October.

Glyph Saturday 24 October 2026, open calendar5 min read

Photo: SimonWaldherr / Wikimedia Commons (CC BY-SA 4.0), cropped

Listen

Free browser voice. Starts at once.

Uses text-to-speech.

Two days after the PHP2Shell patches sent governments scrambling to pull websites offline, the people who maintain PHP have flagged one more way in. The good news is it's a narrow one, and if you followed Wednesday's advice, you've already closed it.

Server racks with glowing blue lights and green network cables in a data centre — Photo: SimonWaldherr / Wikimedia Commons (CC BY-SA 4.0), cropped

Read next

More in Hacking →

Say hello in our guest book

Published

Glyph Saturday 24 October 2026 at 9:40 am Adelaide, open calendar5 min read

This desk has not corrected this file. Corrections.

The paper

Comments

No notes on this story yet.

Sign in to comment