Thirteen days after the emergency patch, the PHP2Shell case is still open. And the bill nobody has paid yet belongs to whoever thinks applying 8.5.12 solved everything.
On the other side, twelve days since the two remote code execution flaws in ksmbd became public, and the fix still has not reached the kernel''s stable tree. Two cases, the same open window.
What the PHP patch covered and what it left out
What the patch covered: CVEs 2026-109618 and 2026-109619, fixed in branches 8.5, 8.4, 8.3 and 8.2, with manual backport for 7.4, 8.0 and 8.1.
What the patch did not cover: CVE-2026-115560, published as an informational advisory two days later, in the same session subsystem, with a one-line mitigation and a fix only in the regular cycle. And the patch bypass claims circulating since then: part contested by technical analysis, part still without a definitive verdict.
What the exploitation showed
Real exploitation did not wait for the calendar. AWS detected exploitation traffic before public disclosure, SecurityWeek reported Mirai operators with ASLR bypass, and this week''s technical coverage describes the exploit chained with other flaws all the way to firewall root. PHP runs on seven in ten sites of the web, and these three vectors do not share a clock.
The ksmbd portrait, 12 days later
No CVE identifier assigned, because the kernel project only numbers them after the fix reaches the stable tree. The fix for one of the paths is moving through the development cycle, with no date for the distributions. The second path still has no named fix. The SMB server built into Linux remains exposed for whoever runs it.
What to do today, in both cases
On PHP, in this order: confirm the PHP version on every host, apply the session.upload_progress.enabled=0 line if the environment does not use the feature, inventory who is still on 7.4, 8.0 or 8.1, and follow the full 115560 advisory.
On the kernel: confirm with systemctl status ksmbd and lsmod | grep ksmbd; unload the module if the server does not need SMB sharing; close port 445 on the firewall; and whoever depends on the service follows the stable tree closely.
Conclusion
The lesson is not about ksmbd or PHP. It is about the window between public detail and available fix, the only period the attacker needs, and about the inventory that closes it: host by host, version by version, loaded module per kernel, documented mitigation. The three articles of this series (PHP2Shell, CVE-2026-115560 and ksmbd) tell the same story from different angles. The surface inventory is the chapter that closes all of them.