Is itCheck something

php2shell No. CVE-2026-115560

A PHP upload progress flaw can let attackers run code

Watch

Watch it. Not confirmed in attacks yet.

Websites on PHP, including WordPress hosting, if configured a certain way.

What to do

Update PHP to the latest version, or ask your web host to do it.

GitHub repos
11
Social interactions today
638K

Part of the same attack (php2shell)

The official description

Two PHP runtime flaws can allow unauthenticated code execution, data exposure, or crashes. A related follow-up, CVE-2026-115560, adds a configuration-dependent session upload progress RCE vector.

What people are saying

Social attention, not a count of victims. Posts shown as written; we don't vouch for them. Data by LunarCrush.

  • StudyIQ IAS · 20.6M followers · YouTube
    Massive Cyberattack: What is PHP2Shell? Ankit Agrawal Study IQOpen post
For your tech helper

A read-only checklist for whoever helps you with your computer, or an AI assistant. Paste it into Claude, ChatGPT or a coding agent; it only looks and changes nothing.

Read-only check, change nothing, send nothing anywhere.
Is php2shell (CVE-2026-115560) installed or running on this machine or in this project?
1. Find every copy and its version (apps, packages, containers, lockfiles).
2. Compare each version against the vendor's fixed version for CVE-2026-115560. Quote the vendor page you used.
3. Report a table: where, version, fixed version, status (exposed / fixed / not installed / unsure).
4. List the exact update steps, but do not run them.
Download playbook (.md)

Code on GitHub

Repos named after this bug. Some are scanners or write-ups, some are working attack code. Do not run them on a machine you care about.

Sources