There's a third PHP2Shell bug, but it won't get an emergency fix

A third PHP vulnerability tied to the PHP2Shell incident has been identified, but the PHP Foundation says it does not warrant an emergency release because exploitation requires an unlikely configuration and can be mitigated by changing a session setting. For CIOs and technology leaders, the business impact is that PHP exposure remains a live operational risk: even when a flaw is judged lower probability, the combination of public exploit activity, widely used internet-facing software, and configuration drift means IT teams need disciplined patching, hardening, and rapid verification across web estates.