American Airlines Just Admitted the Quiet Part Out Loud: Airfares Aren’t Coming Down, Even If Oil Does

 American Airlines Just Admitted the Quiet Part Out Loud: Airfares Aren’t Coming Down, Even If Oil Does

**By a Market Analyst & Business News Writer | October 23, 2026**

---

## The Sentence That Should Make Every American Traveler Angry

Let me tell you about a moment that captures exactly where the airline industry stands right now.

It was an interview with the Financial Times. Devon May, the Chief Financial Officer of American Airlines, was asked a simple question: If oil prices finally fall, will airfares come down too?

His answer was breathtaking in its honesty.

**"If fuel comes down, I think airfares probably stay largely where they're at right now"** .

Read that again. The CFO of the largest airline in the world just told you, on the record, that **the fuel surcharge is permanent**. The price you're paying for your ticket isn't a temporary spike tied to the war in Iran. It's the new baseline.

And if fuel prices go *up*? **"We need to generate higher fares to offset that higher fuel price"** .

There is no scenario in which American Airlines plans to give you a break. Not if oil crashes. Not if the war ends. Not ever.

This is the story of how the Iran war, a record fuel bill, and a decade of industry consolidation created a pricing environment where the airlines can do whatever they want — and they know it.

---

## The Numbers: Record Revenue, Record Losses

Let me show you the paradox at the heart of American Airlines' third-quarter earnings, because the numbers are genuinely staggering.

### The Revenue Triumph

American reported **record third-quarter revenue of $16.3 billion** — up **19.3% year over year** . That's the highest revenue in the company's history, excluding the pandemic recovery years.

The growth came from everywhere:

- **Premium revenue surged 22.9%** 

- **Corporate revenue jumped 28%** — the sixth consecutive quarter of double-digit growth 

- **International passenger unit revenue rose 16.4%**, led by Latin America at 21.1% 

Demand is not the problem. Americans are flying. They're paying more. And they're still showing up.

### The Fuel Catastrophe

But here's the other side of the ledger.

American's **fuel expense surged 67.5% year over year**, adding **$1.9 billion** in additional costs in the third quarter alone. The airline paid an average of **$3.85 per gallon** — a dollar and forty-eight cents more than the same period last year .

And the fourth quarter is going to be worse. American expects to pay **$4.70 per gallon** — nearly double what it paid a year ago. That translates to an additional **$2.8 billion** in fuel expenses .

For the full year, American now expects fuel expenses to be **more than $7 billion higher** than in 2025 .

The result? American reported an **adjusted net loss of $182 million** for the quarter. It expects a full-year adjusted loss of **$1 to $1.60 per share** .

### The Competitive Humiliation

Here's the part that has to sting for American's leadership.

**Delta reported net income of $756 million. United reported just over $1 billion. Southwest reported $270 million.** 

All three of American's major competitors made money in the same quarter. American lost it.

"Something's not adding up at American Airlines," said Dennis Tajer, a spokesperson for the Allied Pilots Association. "The same cloud layer is over the same golf course that Delta [and] United play, but American has a vastly different score" .

The pilots' union is pointing fingers at management. And they have a point. American's fuel costs are a problem for everyone. But only American turned a profit into a loss.

---

## Why Fares Aren't Coming Down: The Industry's New Math

Let me explain the structural change that makes Devon May's statement so devastating.

### The Pandemic Oversupply Hangover

May told the FT something that explains everything: **Airfares never fully recovered in real terms after the COVID pandemic** .

"This [price increase] ideally should have happened back in 2024, but the industry found itself in an oversupply environment," he said. "This was the first year that everything came together in a way that we were able to push yields back up to where they were seven years ago in real terms" .

Think about what that means. For years, airlines were leaving money on the table. They were competing on price, adding capacity, and fighting for market share. The pandemic disrupted that. Then the recovery created a glut of seats.

Now, the Iran war has given them an excuse to do what they've wanted to do all along: **charge what the market will bear.**

And the market, so far, is bearing it. Airfares were up **22.4% year-over-year in September**, according to the Bureau of Labor Statistics .

### The Capacity Lever

Here's the mechanism that makes higher fares stick. American is cutting its **network growth for 2027** compared to 2026 . Less capacity means fewer seats. Fewer seats means higher prices.

"Given today's elevated fuel prices, we now expect our growth rate in 2027 to decelerate considerably," CEO Robert Isom said on the earnings call .

This is the classic airline playbook. When costs rise, cut flights. When you cut flights, the remaining seats become more valuable. You can charge more for them. And you don't have to add them back when costs fall — because why would you?

### The Hedge Is Gone

Here's another reason fares won't fall quickly. Airlines use fuel hedging — essentially, buying insurance against price spikes — to smooth out costs. But as Ryanair's CEO Michael O'Leary warned, those hedges are unwinding. Ryanair has **no pricing protection for 85% of its estimated fuel needs for next year** .

American didn't disclose its hedge position, but the same dynamic applies. When your hedges expire, you're exposed to whatever the market charges. And you'll pass that cost to passengers.

---

## What This Means for Your Wallet

Let me bring this down to earth, because this is about your travel budget.

### The Holiday Travel Shock

If you're planning to fly for Thanksgiving or Christmas, you're already feeling it.

Hopper reported that round-trip domestic fares averaged **$402 for Thanksgiving** and **$452 for Christmas** — **31% and 23% more than last year**, respectively. Those are the highest holiday airfares in a decade .

### The Business Travel Squeeze

Corporate travel is back, and it's driving prices up. American's corporate revenue grew 28% year-over-year, and managed corporate revenue has grown double-digits for six consecutive quarters .

Business travelers are less price-sensitive. They have to fly. And airlines know it.

### The Budget Traveler's Pain

For leisure travelers on a budget, the picture is bleaker. Low-cost carriers like Spirit have collapsed. Others are cutting capacity. The budget options are disappearing.

"If you remove low-cost competition from the equation, then, yes I think that United and those airlines could really get away with these higher fares sticking around for a long time," said Zach Griff, author of an airline newsletter .

---

## What the Experts Are Saying

**Devon May, American Airlines CFO**: "If fuel comes down, I think airfares probably stay largely where they're at right now" .

**Robert Isom, American Airlines CEO**: "We produced a loss in the quarter that, but for this fuel spike, would have been solidly profitable" .

**Michael O'Leary, Ryanair CEO**: "You're going to see the biggest increase in airfares, I would say, in history in Europe in the next 12 months" .

**Melius Research**: "In a challenging operating environment, peers have proven a higher earnings floor, while the jury is still out on American, whose outcome hinges largely on fuel at any given moment" .

**Brett House, Columbia Business School**: "It's not just the level of fuel costs that is a problem or a challenge for airlines. It's also the volatility" .

---

## Frequently Asked Questions (FAQs)

### Q1: Will airfares actually stay high even if oil prices fall?

According to American Airlines CFO Devon May, **yes**. He said fares will "stay largely where they're at right now" even if fuel prices decline. The airline has no plans to pass on savings to consumers .

### Q2: Why is American Airlines losing money when Delta and United are profitable?

American's fuel expense rose 67.5% year-over-year, adding $1.9 billion in costs. But its competitors faced similar fuel increases and still made money. The difference is **revenue management** — Delta and United have been more successful at raising fares to cover costs. American's pilots' union blames management for an "obsessive view on market share versus actually focusing on yield" .

### Q3: How much are airfares up compared to last year?

Airline fares were up **22.4% year-over-year in September 2026**, according to the Bureau of Labor Statistics .

### Q4: Why did airfares never fully recover after COVID?

May explained that the industry found itself in an **oversupply environment** after the pandemic. Airlines were competing on price and adding capacity. "This was the first year that everything came together in a way that we were able to push yields back up to where they were seven years ago in real terms," he said .

### Q5: Will American Airlines cut flights in 2027?

**Yes.** American said it expects its **network growth to decelerate considerably** in 2027 due to elevated fuel prices. Less capacity means fewer seats, which supports higher fares .

### Q6: What should I do if I'm planning to fly?

**Book early.** Holiday fares are already at decade highs. Waiting is unlikely to help. If you have flexibility, consider traveling on less popular days or routes. And expect to pay more for checked bags and seat selection — airlines are increasingly relying on ancillary fees to boost revenue.

### Q7: Is there any chance fares come down?

The only scenario where fares might fall is if **demand collapses**. If the economy slows sharply and Americans stop flying, airlines would be forced to cut prices to fill seats. But so far, demand has remained resilient despite higher prices .

### Q8: What does this mean for American Airlines stock?

AAL closed at **$12.60** on October 22, up nearly 3% for the day . The stock is down significantly from its 52-week high of **$18.79** . The company's full-year loss guidance has disappointed investors, but the long-term picture depends on whether fuel prices stabilize and whether American can close the profitability gap with its peers.

---

## High-Value Keywords for Content Creators and AdSense Publishers

For bloggers, affiliate marketers, and AdSense publishers covering this story, here are the most profitable keywords to target:

### Tier 1: High CPC ($15+)

| Keyword | Estimated CPC | Search Volume |

|---------|--------------|---------------|

| Best travel credit cards 2026 | $25-$40 | Very High |

| How to find cheap flights 2026 | $20-$35 | Very High |

| Best airline deals 2026 | $18-$30 | Very High |

| American Airlines stock forecast | $15-$25 | Very High |

| Best travel insurance 2026 | $15-$22 | High |

### Tier 2: High Volume, Low Competition

| Keyword | Search Volume | Competition |

|---------|--------------|-------------|

| Why are airfares so expensive 2026 | Very High | Low |

| American Airlines Q3 earnings explained | High | Very Low |

| Will airfares go down in 2027 | Very High | Low |

| Why American Airlines is losing money | High | Very Low |

| Jet fuel prices impact on airfares | High | Low |

### Tier 3: Long-Tail Money Keywords

- "Why airfares won't drop even if oil prices fall"

- "American Airlines CFO says fares will stay high"

- "Best time to book flights for 2027 travel"

- "How fuel prices affect airline ticket costs"

- "American Airlines vs Delta vs United profitability comparison"

---

## Conclusion: The Permanent Price Hike

Devon May didn't have to say it. He could have given a diplomatic non-answer about "monitoring the situation" and "responding to market conditions."

Instead, he told the truth. **The fuel surcharge is here to stay.**

For American travelers, the message is clear: **The era of cheap flights is over.** The pandemic disruptions, the Iran war, and the industry's consolidation have created a pricing environment where airlines can charge what they want and consumers have no choice but to pay.

For American Airlines, the message is more complicated. The company is making record revenue but posting losses. Its competitors are profitable. Its pilots' union is questioning management. And its stock is languishing.

For the industry as a whole, the message is simple: **The airlines have figured out that they don't need to compete on price.** They've cut capacity. They've consolidated. They've raised fares. And they're not going back.

Devon May just admitted it. Now the rest of us have to live with it.

---

## Disclaimer

This article is for informational and educational purposes only and does not constitute financial, investment, or travel advice. The information contained herein is based on publicly available sources as of October 23, 2026. Airline fares, stock prices, and fuel costs are subject to change. The author and publisher are not responsible for any decisions made based on the information presented in this article. Always consult a qualified financial advisor before making any investment decisions and check current fares directly with airlines before booking travel.

---

**Tags**: #AmericanAirlines #AAL #Airfares #AirTravel #TravelNews #AirlineNews #DevonMay #RobertIsom #IranWar #JetFuel #FuelPrices #Inflation #StockMarketNews #Investing #MarketAnalysis #FinancialNews #Delta #United #Southwest #AirlineStocks #TravelTips #CheapFlights #ThanksgivingTravel #ChristmasTravel #HolidayTravel #CapacityCuts #AirlineIndustry #AviationNews #AmericanConsumers #PersonalFinance #TravelBudget #StockMarket2026 #AmericanInvestors #WallStreet #EarningsReport #Q3Earnings #Aviation #FrequentFlyer #TravelHacks #AirlineEconomics #FuelHedge #SpiritAirlines #Ryanair #MichaelOLeary

Dow Tumbles 600 Points as Middle East Tensions Rise — And the Selling Is Spreading Far Beyond Tech

Dow Tumbles 600 Points as Middle East Tensions Rise — And the Selling Is Spreading Far Beyond Tech

**By a Market Analyst & Business News Writer | October 23, 2026**

---

## The Selloff That Started in Tech and Ended Everywhere

Let me tell you about a moment that captures exactly how fragile this market has become.

On Friday morning, October 23, 2026, the Dow Jones Industrial Average didn't just slip. It **plunged more than 600 points** — a drop of over 1% that sent the blue-chip index tumbling to around **52,200** . The S&P 500 fell about **0.5%**, and the Nasdaq, which had been the epicenter of the week's pain, actually held up relatively well — down only about **0.1%** .

For weeks, the story on Wall Street has been simple: **AI stocks are getting crushed, and everything else is fine.** Investors were rotating out of the high-flying tech names that had driven the market to record highs and into safer, more boring sectors.

That story died on Friday.

The selling **broadened**. Defensive sectors — consumer staples, utilities, healthcare — got hit too. **American Express fell more than 3%** after announcing plans to cut about **5% of its global workforce** to adapt to AI. **Caterpillar dropped 2%**. **Goldman Sachs lost 1%** .

And the reason wasn't a tech earnings miss or an AI bubble popping. It was something much more primal: **oil**.

---

## The Middle East Just Got More Dangerous

Let me explain what happened, because the sequence of events matters.

### The Tanker Attacks

On Thursday, October 22, Iran's Islamic Revolutionary Guard Corps announced that **seven ships** had been attacked or struck mines in and around the **Strait of Hormuz** in a single day. Four were "violating" vessels that Iran tracked and intercepted; three more hit mines while trying to cross at night .

It was the **highest single-day toll of damaged vessels** since the U.S.-Iran conflict began in February .

Iran's military chief said the strait was "under effective control" and warned that any enemy vessels entering the area would be targeted. The message was unmistakable: **Iran is escalating its maritime campaign to pressure Washington before the November midterms** .

### The Oil Spike

The market's reaction was immediate. **Brent crude surged above $115 a barrel** — its highest level in five months. **WTI climbed above $100** . By Friday morning, Brent was trading around **$114**, and WTI hovered near **$100.90** .

The logic is simple and brutal. The Strait of Hormuz is the world's most important oil chokepoint. If Iran can disrupt traffic there, global supplies tighten. Prices rise. Inflation fears reignite. And the Federal Reserve's already difficult job gets even harder.

### The Political Dimension

Adding to the anxiety: reports that the U.S. and Israel have drawn up plans to **resume strikes on Iran after the November 3 midterms**. President Trump has publicly said the U.S. "may take further action" and reiterated that Iran must never have a nuclear weapon .

A U.S. envoy even said an attack could happen **"as early as this weekend"** .

The market is now pricing in a **geopolitical risk premium** that it had started to forget. And that premium is hitting everything.

---

## The Deeper Problem: The AI Trade Is Cracking

Let me connect the dots, because Friday's selloff isn't just about oil.

### The SK Hynix Shock

Overnight, **SK Hynix** — one of the world's largest memory chip makers and a major beneficiary of the AI boom — **scrapped its plan for a $10 billion U.S. IPO** of its Solidigm unit. The company cited opposition from regulators and shareholders .

The message was clear: **Even the companies at the heart of the AI supply chain are getting nervous about the market's appetite for AI-related offerings.** SK Hynix pulled its deal. Others may follow.

### The CoreWeave Warning

**CoreWeave**, the AI cloud provider that has become the poster child for AI debt concerns, fell another **10% on Thursday** and was down slightly on Friday . The company has borrowed heavily to build data centers, and investors are questioning whether the returns will justify the debt.

### The Yardeni Verdict

Ed Yardeni, one of the most respected strategists on Wall Street, called the AI trade a **"bubble"** on Thursday. But he added a crucial caveat: letting some air out of the bubble might actually be **healthy** .

"I don't think it has to burst and cause problems for the whole economy," he said. But he also noted that **the bond market is competing with stocks for capital** — and at 5% yields, bonds are winning .

---

## The Bond Market's Brief Relief

Here's the one piece of good news in an otherwise brutal week.

On Thursday, as stocks sold off, investors fled to the safety of U.S. Treasuries. The **10-year yield fell below 5%** for the first time in a month. The **30-year yield dropped 10 basis points to 5.30%**. The **five-year fell 15 basis points to 4.80%** .

It was the **largest single-day decline in yields in three and a half years** .

But by Friday, the relief had faded. The 10-year yield ticked back up to **4.97%**. The bond market's brief rally was over .

The message: **Even the safe haven isn't safe.** The same geopolitical fears that are driving oil prices higher are also driving inflation expectations higher — which pushes yields back up.

---

## What the Experts Are Saying

**Florian Ielpo, Lombard Odier Asset Management**: "Yesterday the market didn't stop believing in AI. It just started asking who pays for it, and with bond yields at 5%, that question involves an opportunity cost" .

**Charlie McElligott, Nomura Securities International**: "The AI sector has come under strong pressure. U.S. Treasuries are once again serving as portfolio insurance. The market is repricing in real time, factoring in the rising probability of a U.S. economic slowdown as a consequence of the AI industry shakeout" .

**Michael Hartnett, Bank of America**: Investors' reluctance to take risk will likely persist until November. Markets haven't fully priced in a scenario where Democrats win both the House and Senate — a result that could negatively affect corporate earnings growth and end the current environment of low taxes and limited regulation .

---

## Frequently Asked Questions (FAQs)

### Q1: Why did the Dow fall 600 points on October 23?

The Dow fell because **Middle East tensions escalated sharply**. Iran attacked or mined seven ships in the Strait of Hormuz on October 22, the highest single-day toll of the conflict. Oil prices surged — Brent above $115, WTI above $100 — reigniting inflation fears. The selling broadened beyond tech into defensive sectors as investors priced in a wider economic risk .

### Q2: Why is the selling spreading beyond tech?

Because the risk isn't isolated to AI anymore. **Higher oil prices feed inflation**, which keeps the Federal Reserve hawkish and bond yields elevated. That hurts every sector — not just tech. When investors get scared about the macro picture, they sell everything, including the defensive stocks they had been hiding in .

### Q3: What happened with SK Hynix?

**SK Hynix scrapped its plan for a $10 billion U.S. IPO** of its Solidigm unit, citing opposition from regulators and shareholders. The decision signals that even major AI beneficiaries are losing confidence in the market's appetite for AI-related offerings .

### Q4: Is the AI bubble bursting?

That's the debate. **Ed Yardeni called it a "bubble"** but said letting some air out might be healthy. The concern is that the bubble is now colliding with **higher bond yields** and **geopolitical risk** — a combination that could turn a controlled deflation into a disorderly selloff .

### Q5: Why did Treasury yields fall and then rise again?

Yields fell on Thursday as investors **fled to safety** amid the stock selloff. The 10-year dropped below 5%. But on Friday, yields ticked back up because **oil prices kept rising**, feeding inflation expectations. The safe-haven rally was short-lived .

### Q6: What does this mean for American consumers?

**Higher oil prices mean higher gas prices.** Brent above $115 translates to pain at the pump. And if inflation fears keep bond yields elevated, **mortgage rates and credit card rates will stay high**. The geopolitical risk premium is being paid by every American household .

### Q7: What should investors watch next?

Watch: (1) **Oil prices** — the single biggest driver right now; (2) **the Strait of Hormuz** — any further escalation could spike prices; (3) **the November midterms** — reports suggest U.S.-Israel strikes on Iran may resume after the election; and (4) **AI earnings** — whether companies can justify their spending .

### Q8: Is this a buying opportunity?

That depends on your risk tolerance and time horizon. Some analysts, like Yardeni, believe the AI trade needed a cooldown and that the long-term story remains intact. But with oil prices rising, bond yields elevated, and geopolitical risk escalating, the near-term outlook is highly uncertain. Consult a qualified financial advisor before making any decisions .

---

## High-Value Keywords for Content Creators and AdSense Publishers

For bloggers, affiliate marketers, and AdSense publishers covering this story, here are the most profitable keywords to target:

### Tier 1: High CPC ($15+)

| Keyword | Estimated CPC | Search Volume |

|---------|--------------|---------------|

| Best energy stocks to buy 2026 | $25-$40 | Very High |

| Oil price forecast 2026 | $20-$35 | Very High |

| Best high-yield savings accounts 2026 | $18-$30 | Very High |

| How to protect portfolio from geopolitical risk | $15-$25 | High |

| Best defensive stocks for 2026 | $15-$22 | High |

### Tier 2: High Volume, Low Competition

| Keyword | Search Volume | Competition |

|---------|--------------|-------------|

| Why did the Dow fall today | Very High | Low |

| Strait of Hormuz tanker attacks explained | High | Very Low |

| Why is oil prices rising October 2026 | Very High | Low |

| SK Hynix IPO cancelled explained | High | Very Low |

| AI bubble vs oil prices market impact | High | Low |

### Tier 3: Long-Tail Money Keywords

- "Why the Dow dropped 600 points October 23 2026"

- "How Iran tanker attacks affect US gas prices"

- "Is the AI trade over after SK Hynix IPO withdrawal"

- "Best investments during Middle East oil crisis"

- "How to hedge portfolio against geopolitical risk 2026"

---

## Conclusion: A Market With Nowhere to Hide

Friday's selloff was a warning. Not just about AI. Not just about oil. About the **fragility of a market that has been running on hope for too long**.

The hope was that AI would deliver extraordinary profits without extraordinary costs. The hope was that the Middle East would stay calm. The hope was that the Federal Reserve could tame inflation without crashing the economy.

One by one, those hopes are being tested.

**Oil is above $100.** **The Strait of Hormuz is a war zone.** **SK Hynix just pulled its AI IPO.** **The Dow is down 600 points.** And the selling is no longer confined to the stocks that started it.

For American investors, the message is clear: **This is not a market for complacency.** The AI trade is repricing. The geopolitical risk premium is back. And the bond market, which briefly offered shelter, is already turning away.

For American consumers, the message is simpler: **The war in the Middle East is about to hit your wallet again.** Higher oil prices mean higher gas prices, higher heating bills, and higher inflation. The Federal Reserve will have to respond. And the cost of borrowing will stay high.

The market has nowhere to hide. And neither do you.

---

## Disclaimer

This article is for informational and educational purposes only and does not constitute financial, investment, or trading advice. The information contained herein is based on publicly available sources as of October 23, 2026. Stock market investments involve risk, including the potential loss of principal. Past performance is not indicative of future results. The author and publisher are not responsible for any financial decisions made based on the information presented in this article. Always consult a qualified financial advisor before making any investment decisions. The author does not hold positions in any of the securities mentioned.

---

**Tags**: #StockMarketToday #DowJones #SP500 #Nasdaq #OilPrices #BrentCrude #WTICrude #StraitOfHormuz #IranWar #MiddleEastTensions #GeopoliticalRisk #AIStocks #SKHynix #CoreWeave #TreasuryYields #BondMarket #FederalReserve #Inflation #Investing #MarketAnalysis #FinancialNews #StockMarketNews #AmericanInvestors #WallStreet #EnergyStocks #DefensiveStocks #MarketSelloff #October2026 #InvestmentStrategy #RiskManagement

The 'Choose Your Own Adventure' Earnings: Why Retailers Are Handling Tariff Refunds So Differently

 

The 'Choose Your Own Adventure' Earnings: Why Retailers Are Handling Tariff Refunds So Differently

## The $166 Billion Distortion

Last quarter, the retail sector delivered some of the best headline numbers in recent memory. Walmart beat. Home Depot beat. Target beat. Abercrombie & Fitch reported a 114% earnings surprise. Investors cheered. Stocks soared.

But here's the catch: a meaningful share of those profits didn't come from selling more to shoppers. They came from a Supreme Court decision. And the way retailers are handling that windfall is creating one of the most confusing earnings seasons in years.

## The Supreme Court's Surprise

On February 20, 2026, the Supreme Court struck down President Trump's IEEPA-era tariffs as unlawful, triggering one of the largest corporate cash windfalls in recent memory. Roughly $166 billion had been collected from some 330,000 importers. By the end of July, approximately $100 billion had been refunded .

Retailers are booking those refunds now. The amounts are enormous and wildly uneven .

## The "Choose Your Own Adventure" Divergence

Bryan Eshelman, a managing director in the retail practice at consulting firm AlixPartners, put it simply: "These trails aren't always clean in terms of finding the right way to apply, in a fair sense, the rebate to prices" .

The divergence comes down to two factors :

1. **Price Positioning**: Value-driven companies are more likely to apply funds to keep prices lower and "proclaim that to the marketplace." Premium retailers often use the windfall differently.

2. **Importer Status**: Much of what's sold in stores isn't necessarily imported by the retailer. U.S. manufacturers may be the ones receiving rebates for raw materials, making the refund trail more complex.

## The Two Paths: Price Cuts vs. Margin Boosts

### Path 1: Passing It On

**Walmart** took the most aggressive approach. CFO John David Rainey told CNBC the company was eligible to receive roughly $2.9 billion in tariff refunds — the largest disclosed by any U.S. company . The company has received "substantially all" of that amount and has begun investing the capital into "customer experience and price leadership" . Rainey noted that the company's Q3 guidance "reflects the continued impact of pricing actions taken in Q2 alongside continued prioritization of tariff refunds and the price investment" . CEO John W. Furner said on an earnings call, "Our intent was to deploy much of that back into price, and that's what we're doing" .

**Home Depot** received $730 million in tariff refunds and used roughly $685 million of that money to reduce the cost of goods sold . CFO Richard McPhail said on a call with analysts that those funds represent "the vast majority" of what the company was expecting to receive . All told, Home Depot is using the reimbursements to fully offset unplanned cost pressure on fuel, energy, and product inputs .

**TJX Cos.** also said it used its $331 million in tariff refunds to benefit its second-quarter cost of sales .

### Path 2: Keeping It

**Lowe's** took a different approach. CEO Marvin Ellison told CNBC the company received roughly $80 million in repayments and did not plan to use tariff dollars to lower prices . "We feel strongly that we want to deliver strong profitability for our shareholders and make sure that we don't follow any aggressive pricing action," he said . The refund gave Lowe's an 11-cent boost to its earnings per share .

**Target** also did not explicitly say whether the company was using its tariff refunds to cut prices, though the company said it lowered prices on more than 10,000 items in the second quarter . Still, the retailer said tariff refunds gave it a $752 million boost to net earnings, or $1.65 per share .

## The Accounting Maze

Why can't retailers just apply refunds uniformly? The answer lies in a complex web of accounting rules.

Under U.S. GAAP, tariff refunds are typically classified as gain contingencies under ASC 450. According to accounting experts, these generally cannot be recognized until they are "realized or virtually certain" . However, if a company originally expensed the tariff costs through cost of goods sold, it may be able to recognize a refund receivable when recovery is "probable" under the loss recovery model (ASC 410-30) .

The treatment also depends on where the tariff costs originally landed :

- If the tariff was expensed through COGS as inventory sold, the refund reduces COGS in the period of recognition.

- If the tariff was capitalized into inventory still on hand, the refund reduces the inventory's carrying value.

- If the tariff was capitalized into fixed assets, the refund reduces the asset's tax basis.

This is why some retailers like Walmart and Home Depot recorded refunds as a reduction in cost of goods sold, while others like Target emphasized adjusted EPS excluding tariff refunds .

## The Consumer Takeaway: Who Gets the Money?

The divergence is particularly significant because consumers bore the brunt of the original tariffs. The New York Federal Reserve reported that approximately 90% of the tariffs' "economic burden" was felt by U.S. firms and consumers . Yet many companies are largely keeping the windfalls for themselves .

The Yale Budget Lab estimates the Trump administration's tariff policy is raising each household's annual costs by approximately $1,100 per year as of August .

## What Investors Should Watch

The tariff refund situation has "muddied retailers' earnings reports" , making cross-retailer comparisons "close to meaningless unless you normalize for it" .

To find the real winners, analysts recommend :

1. **Focus on comp sales and traffic** instead of headline EPS and revenue.

2. **Screen out earnings juiced by tariff refunds** to understand underlying performance.

3. **Parse true operational improvement from one-time windfalls** .

**Dollar General** provided the cleanest example. The company earned $2.48 per share in the period, and management estimated that only 25 cents of that figure came from tariff refunds . Removing that boost leaves EPS of $2.23 per share, still well above expectations .

**Abercrombie & Fitch** deserved credit for the most transparent disclosure of the season. While the stock soared more than 30% on a 114% beat, management specified that the IEEPA refund contributed approximately $100 million pre-tax, or $1.75 per diluted share . Back that out, and underlying EPS was roughly $2.42—still a genuine beat of about 24%, but a fundamentally different number .

**Williams-Sonoma** stood out as the cleanest performer. Management raised full-year margin guidance and said it did not factor in any tariff refunds . Comparable brand revenue rose 6.2%, accelerating from 4.8% last quarter .

## Frequently Asked Questions (FAQs)

### 1. Why are retailers handling tariff refunds so differently?

Retailers' approaches depend on their price position in the market, whether they are the importer of record, and the accounting treatment of their original tariff costs. Value-driven retailers like Walmart are more likely to pass refunds on to consumers, while others use the windfall to boost margins .

### 2. Which retailers are using tariff refunds to lower prices?

Walmart has been the most explicit, stating it plans to deploy the majority of its $2.9 billion refund back into prices. Home Depot and TJX have used refunds to reduce cost of goods sold . Amazon and Best Buy have also suggested they will pass some savings to consumers .

### 3. Which retailers are keeping the refunds?

Lowe's has stated it does not plan to use tariff dollars to lower prices, instead using the refund to boost profitability . Target has not explicitly committed to price cuts with its refund, though it did lower prices on thousands of items .

### 4. How much did retailers receive in tariff refunds?

Walmart received the largest disclosed amount at $2.9 billion. Target reported $994 million. Home Depot received $730 million. TJX received $331 million. Lowe's received $80 million. Ross received $253 million .

### 5. Why can't consumers get tariff refunds directly?

While consumers have filed class-action lawsuits against companies receiving tariff refunds, none have finished playing out in court yet. Americans have little recourse to recover tariff funds if companies don't pass on refunds voluntarily .

### 6. How are tariff refunds accounted for in earnings?

It depends. If a company expensed the tariff costs through COGS, it may recognize the refund as a COGS reduction . If the tariff was capitalized into inventory, the refund may reduce inventory carrying value . The accounting treatment varies based on when the goods were sold .

## The Bottom Line

The tariff refund bonanza has turned this earnings season into a "choose your own adventure" story . Some retailers are passing the savings to consumers. Others are keeping it for shareholders. The accounting is messy. The comparisons are confusing.

But one thing is clear: the consumer ultimately paid those tariffs . And whether they'll get any of that money back depends entirely on which retailer they're shopping with.

Mark Zuckerberg Owns 13% of Meta but Controls 61% of the Votes — And California's Wealth Tax Is About to Bill Him on the 13%

 

Mark Zuckerberg Owns 13% of Meta but Controls 61% of the Votes — And California's Wealth Tax Is About to Bill Him on the 13%

**By a Market Analyst & Business News Writer | October 23, 2026**

---

## The 13% vs. 61% Problem

Let me tell you about a number that captures the absurdity, the power, and the sheer audacity of American corporate governance in a single sentence.

**Mark Zuckerberg owns roughly 13% of Meta Platforms. He controls 61% of its voting power.**

That's not a typo. Through a dual-class share structure that gives him "supervoting" shares with ten votes each, the man who founded Facebook in his Harvard dorm room has **absolute control** over a company worth nearly **$1.8 trillion** — despite owning an economic stake that's a fraction of that .

And now, California's **Proposition 40** — a one-time **5% wealth tax** on billionaires — is threatening to expose the gap between what Zuckerberg *owns* and what he *controls*. Because the tax would be levied on his **13% economic stake**, not his 61% voting power. But if he had to sell his supervoting shares to pay the bill, his control could be **permanently reduced** .

What happened next is a masterclass in corporate leverage, billionaire panic, and the uncomfortable truth about how American capitalism actually works.

---

## The Ultimatum: 96 Hours to Save the Board

Let me take you inside the negotiations, because the SEC filings reveal something extraordinary.

According to documents filed with the Securities and Exchange Commission on Wednesday, Zuckerberg had been negotiating with Meta's board since **July 2026**. He wanted a way to pay a potential wealth tax bill of nearly **$12.5 billion** without selling his supervoting shares .

The board was sympathetic. They wanted to keep him. But negotiations dragged on.

Then came the dinner.

On **September 9, 2026**, Zuckerberg sat down with board members and effectively delivered an ultimatum. If a deal wasn't struck, he would **sell his home in Palo Alto** — and the listing would be **public**. He planned to put the house on the market on **September 13**, giving the board **96 hours** to avert a public relations crisis .

Think about what that means. The founder of Meta — one of the most valuable companies on Earth — was threatening to publicly signal that he was **leaving California** because of a tax that hadn't even passed yet. The listing of his home would have been a news event. It would have been interpreted as a declaration of war against Proposition 40. And it would have made Meta's board look powerless to keep its own CEO.

The board scrambled. On Wednesday, they unveiled the solution.

---

## The Solution: A New Class of Stock That Solves Everything (For Zuckerberg)

Here's what Meta's board came up with, and it's genuinely clever.

In **January 2027**, Meta will issue a **new class of non-voting Class C common stock** to shareholders. Zuckerberg will receive a chunk of these shares, which he can **sell immediately** — up to **20% of the Class C shares he receives**, representing about **10% of his overall economic stake** .

That gives him the liquidity to pay a potential **$12.5 billion** tax bill without touching his supervoting shares. His **60.6% voting power** stays intact .

In exchange, Zuckerberg committed to **remain a California resident** — or wherever Meta maintains its headquarters — for **eight years** .

It's a win-win. For Zuckerberg, who gets to keep control while cashing out a portion of his stake. For Meta, which gets to retain its founder-CEO at a time when it's spending **$145 billion** on AI infrastructure and desperately needs stability. And for the board, which avoids the PR nightmare of its CEO publicly fleeing the state.

But here's the thing that nobody is talking about: **The solution only exists because Zuckerberg had leverage.** He could threaten to leave. He could threaten to sell his house. He could force the board's hand because he controls **61% of the votes** — including the votes that determine who sits on the board .

For any other employee, any other shareholder, any other executive, the answer would have been: *Sell your shares and pay your taxes like everyone else.* For Zuckerberg, the answer was: *We'll create a whole new class of stock for you.*

---

## What Proposition 40 Actually Does

Let me break down the tax itself, because the details matter.

### The Basics

**Proposition 40** — officially the "2026 Billionaire Tax Act" — would impose a **one-time 5% tax** on the net worth of anyone who was a **California resident on January 1, 2026** and whose wealth exceeds **$1 billion** .

The tax would be calculated based on net worth as of **December 31, 2026**. It would apply to stocks, bonds, business ownership, and collectibles — but **not** real estate, pensions, or retirement accounts .

Payment is due starting in **2027**, with an option to pay over **five years** at a higher total cost .

### The Revenue Projections

Supporters — led by the **SEIU-United Healthcare Workers West** union — project the tax would raise **$100 billion** from California's approximately **200 billionaires**. The money would be allocated **90% to healthcare** and **10% to education and food assistance** .

But a new working paper from the **National Bureau of Economic Research** tells a very different story. Stanford economists **Benjamin Jaros** and **Joshua Rauh** estimate the tax would collect between **$28 billion and $36 billion** — less than a third of the official projection. And they warn that when you factor in the **permanent loss of income tax revenue** from billionaires who leave the state, the net present value of the tax is **negative $38.9 billion** .

Their model ran **100,000 simulations**. In **85% of scenarios**, the state loses money .

---

## The Billionaire Revolt: Who's Already Left

Let me introduce you to the people who aren't waiting around to find out if Prop 40 passes.

### The Departures

The NBER paper identified **seven billionaires** who reportedly left California before the January 1, 2026 residency cutoff :

- **Larry Page** — Google co-founder

- **Sergey Brin** — Google co-founder

- **Peter Thiel** — Investor

- **Steven Spielberg** — Director

- **Travis Kalanick** — Uber co-founder

- **David Sacks** — Tech investor and Federal AI Czar

- **Don Hankey** — Car loan tycoon

Together, they accounted for nearly **30% of the wealth** the researchers considered potentially taxable .

### The Fight Back

Sergey Brin has contributed **at least $102 million** to **Building a Better California**, a political action committee opposing Prop 40. The committee has raised **$118 million** from prominent billionaires .

The opposition campaign — dubbed **"Stop the Squeeze"** — is highlighting that **Governor Gavin Newsom**, both candidates for governor, and even **Planned Parenthood** and the **California Teachers Association** oppose the measure .

### The Political Divide

Here's the fascinating part: **California Democrats are split down the middle.**

The **California Democratic Party** and the **California Labor Federation** have both endorsed Prop 40. Polls show **65% of rank-and-file Democrats** support it .

But **Governor Newsom** opposes it. So does his likely successor, **Xavier Becerra**. So does **Los Angeles Mayor Karen Bass**. And the **San Francisco Democratic Party** voted **17-4** to oppose it — bucking the state party .

The reason? **Fear of capital flight.** As one San Francisco Democratic Party member put it: "It very likely will lead to people choosing to not create businesses that they think are going to be very successful in California, just so they are not subject to a future tax" .

---

## The Zuckerberg Deal: What It Really Reveals

Let me step back and think about what this moment says about American capitalism.

### The Leverage Gap

Zuckerberg's deal with Meta's board is a **textbook example of founder privilege**. The board didn't create a new stock class for ordinary shareholders. It didn't create one for employees. It created one **specifically** to protect Zuckerberg's control while allowing him to cash out.

The filing reveals that Zuckerberg **considered moving out of California** because of the tax. Meta's board concluded that it **needed** him to stay — citing "unprecedented challenge and competition in our industry" and the need to raise "hundreds of billions of dollars" for AI growth .

So they gave him what he wanted.

### The Irony of the 13%

Here's the number that keeps coming back to me. **13%.**

That's Zuckerberg's economic stake in Meta. That's what the wealth tax would be levied on. A 5% tax on his net worth — which is overwhelmingly Meta stock — would be a tax on his **13% ownership**.

But his **61% voting control** is what gave him the power to negotiate a deal that protects him from having to sell the shares that carry that control.

The wealth tax is designed to tax **wealth**. But the deal Meta struck is designed to protect **power**. And in America, those two things are not the same.

### The Precedent

If Prop 40 passes, and if other billionaires follow Zuckerberg's playbook, we could see a wave of **corporate restructurings** designed to protect founders from wealth taxes. New stock classes. New liquidity mechanisms. New ways to convert economic value into cash without surrendering control.

That's not necessarily illegal. It's not even necessarily bad. But it is a **profound shift** in how the tax code interacts with corporate governance.

---

## Frequently Asked Questions (FAQs)

### Q1: What is Proposition 40?

Proposition 40 is a California ballot measure that would impose a **one-time 5% tax** on the net worth of anyone who was a California resident on **January 1, 2026** and whose wealth exceeds **$1 billion**. It would raise tens of billions for healthcare and education .

### Q2: How much would Mark Zuckerberg owe?

Based on his estimated net worth of **$247 billion**, Zuckerberg could face a tax liability of nearly **$12.5 billion** .

### Q3: What did Meta do to help Zuckerberg?

Meta's board created a **new class of non-voting Class C stock** that Zuckerberg can sell to pay the tax without reducing his **60.6% voting control**. He can sell up to **10% of his economic stake** immediately. In exchange, he committed to remain a California resident for **eight years** .

### Q4: Why did Meta's board agree to this?

Meta said it needs Zuckerberg to continue managing the company from Menlo Park "at a time of unprecedented challenge and competition in our industry" and as it raises "hundreds of billions of dollars" for AI growth . The board also feared the PR crisis of Zuckerberg listing his Palo Alto home for sale .

### Q5: Will Prop 40 actually pass?

Polls suggest a **tight result**. It has strong support among rank-and-file Democrats, but is opposed by Governor Newsom and many elected officials. The outcome is uncertain .

### Q6: What do economists say about the tax?

It's divided. Supporters cite six Nobel Prize winners who called it the "first opportunity for the people to start reining in the power of billionaires" . Critics point to the NBER paper estimating a **net loss of $38.9 billion** due to capital flight .

### Q7: Have billionaires already left California?

Yes. The NBER paper identified **seven billionaires** who reportedly left before the January 1, 2026 cutoff, representing nearly **30% of the potentially taxable wealth base** .

### Q8: What happens if the tax passes and Zuckerberg sells his Class C shares?

He'd pay the tax without losing voting control. But the new shares would dilute existing shareholders' economic interest. And the precedent of creating special stock classes to protect founders from taxes could spread to other companies.

---

## High-Value Keywords for Content Creators and AdSense Publishers

For bloggers, affiliate marketers, and AdSense publishers covering this story, here are the most profitable keywords to target:

### Tier 1: High CPC ($15+)

| Keyword | Estimated CPC | Search Volume |

|---------|--------------|---------------|

| Best tax planning strategies 2026 | $25-$40 | Very High |

| How to reduce capital gains tax | $20-$35 | Very High |

| Best wealth management advisors | $18-$30 | High |

| Mark Zuckerberg net worth | $15-$25 | Very High |

| Best states for taxes 2026 | $15-$22 | High |

### Tier 2: High Volume, Low Competition

| Keyword | Search Volume | Competition |

|---------|--------------|-------------|

| California Proposition 40 explained | Very High | Low |

| Mark Zuckerberg Meta wealth tax deal | Very High | Low |

| What is the 2026 Billionaire Tax Act | High | Very Low |

| Prop 40 pros and cons | High | Low |

| Billionaires leaving California 2026 | High | Low |

### Tier 3: Long-Tail Money Keywords

- "How much would Mark Zuckerberg pay under Prop 40"

- "Why did Meta create a new stock class for Zuckerberg"

- "California wealth tax capital flight explained"

- "Best states to move to avoid wealth tax"

- "What is the 13% vs 61% voting control issue at Meta"

---

## Conclusion: The 13% That Exposes Everything

Mark Zuckerberg owns **13%** of Meta. He controls **61%** of its votes. And when California threatened to tax his **13%**, his **61%** gave him the power to negotiate a deal that protected both.

That's the story in a nutshell. The wealth tax is designed to reach the **economic value** of billionaire holdings. But corporate governance is designed to protect **control**. And when the two collide, the people with control have options that the people without it do not.

For American investors, the message is clear: **Dual-class share structures create risks that aren't always visible in the financial statements.** When a founder controls 61% of the votes but owns 13% of the economics, their interests and yours are not perfectly aligned. The Zuckerberg deal is a reminder of that gap.

For American taxpayers, the message is more uncomfortable: **A wealth tax is easy to announce and hard to collect.** The NBER paper's estimate of a **$38.9 billion net loss** is a warning. Billionaires have accountants, lawyers, and boards willing to restructure entire companies to protect them. The tax might raise money. But it might cost more than it raises.

For Mark Zuckerberg, the message is simpler: **He won.** He gets to pay his tax bill without losing control. He gets to stay in California. And he gets a new class of stock that exists, essentially, because he asked for it.

The 13% got billed. But the 61% called the shots.

---

## Disclaimer

This article is for informational and educational purposes only and does not constitute financial, tax, or investment advice. The information contained herein is based on publicly available sources as of October 23, 2026. Tax laws and ballot measures are subject to change and legal challenge. The author and publisher are not responsible for any decisions made based on the information presented in this article. Always consult a qualified financial advisor or tax professional before making any financial decisions.

---

**Tags**: #MarkZuckerberg #Meta #META #Proposition40 #WealthTax #California #BillionaireTax #StockMarketNews #Investing #MarketAnalysis #FinancialNews #DualClassStock #CorporateGovernance #ShareholderRights #TaxPolicy #AmericanInvestors #WallStreet #TechStocks #BigTech #CapitalFlight #NBER #Stanford #TaxPlanning #WealthManagement #StockMarket2026 #CaliforniaPolitics #GavinNewsom #SEIU #ClassCStock #NonVotingShares

PHP Just Warned of Another Unpatched RCE Risk — Two Days After the PHP2Shell Emergency Patch

 

PHP Just Warned of Another Unpatched RCE Risk — Two Days After the PHP2Shell Emergency Patch

**By a Technology Analyst & Business News Writer | October 23, 2026**

---

## The Second Alert Nobody Wanted to See

Let me tell you about a week that has shaken the foundations of the internet.

On **Tuesday, October 20, 2026**, the PHP security team did something it almost never does. It issued an advance warning of a critical security release — a heads-up that two vulnerabilities in the PHP programming language were so severe that patches would drop in less than 48 hours, and everyone needed to get ready .

The vulnerabilities were tracked as **CVE-2026-109618** and **CVE-2026-109619** — collectively nicknamed **PHP2Shell**. Both were rated **CVSS 9.2 out of 10**. Both allowed **unauthenticated remote code execution** — meaning an attacker could take over a server without even logging in .

Then, on **Friday, October 23, 2026** — just two days after the emergency patches went live — PHP issued another advisory. A **third vulnerability**, tracked as **CVE-2026-115560**. Another remote code execution risk. And this time, **no emergency patch** .

For the millions of Americans who run websites, manage servers, or simply use the internet every day, this is a moment that demands attention. Because the software at the center of this storm — PHP — powers roughly **70% of the web** .

---

## What Is PHP2Shell? The Flaw That Broke the Internet's Assumptions

Let me break this down in plain English, because the technical details matter.

### The Basics

PHP is a programming language that runs on the **server side** — it's what makes websites dynamic. WordPress, which powers over 40% of all websites, runs on PHP. So does Magento, Drupal, and countless custom applications .

The PHP2Shell vulnerabilities weren't flaws in any specific application. They were flaws in **PHP itself** — the core engine that processes every web request .

That distinction is crucial. It means **even a perfectly secure website was at risk** if it ran on a vulnerable version of PHP. The attacker didn't need to find a bug in your code. They just needed to send a specially crafted request to your server .

### How the Attack Works

Both vulnerabilities exploited how PHP handles memory when something goes wrong during request processing.

**CVE-2026-109618** was triggered by exhausting PHP's memory. When a request consumed too much memory, PHP's cleanup process could leave behind improperly initialized data. An attacker could then manipulate that leftover data to execute code .

**CVE-2026-109619** was subtler. It involved "stale state" — references to memory that had already been released. When a PHP worker process handled a later request, it could follow those outdated references and access memory it shouldn't. That could expose sensitive data or allow code execution .

The result? An attacker could potentially read passwords, API keys, and session tokens from other users' requests. Or they could run their own code on your server .

### The Scale of the Threat

The numbers are staggering.

According to VirusTotal, there were approximately **5.1 million IP addresses running PHP** as of October 21, 2026. Of the ones that disclosed their version, roughly **four in five were running an end-of-life branch** — meaning they wouldn't receive an official patch .

Modat, another scanner, counted **4.38 million PHP services on 1.89 million unique hosts**. About **79%** were running a version PHP no longer supports .

And here's the part that should worry every American business owner: **PHP 8.2 reaches end of life on December 31, 2026**. That's in two months. If you're running PHP 8.2, you need to upgrade to 8.3 or later before the end of the year, or you'll be running unsupported software .

---

## The Emergency Response: What Happened on October 21

The PHP team didn't sit on this. They moved fast.

### The Patches

On **October 21, 2026**, PHP released fixed versions:

- **PHP 8.5.12**

- **PHP 8.4.27**

- **PHP 8.3.36**

- **PHP 8.2.35**

For older versions — PHP 7.4, 8.0, and 8.1 — the team published **source code backports**, but no official binary releases. Those branches are end-of-life and no longer officially supported .

### The Chaos in Europe

The disclosure triggered an extraordinary response across Europe.

Several Dutch websites — including **Tweakers**, the **House of Representatives**, **NCSC-NL**, and **Security.NL** — went offline on October 21 as a precaution . National CERTs including the **UK NCSC** and **CERT Polska** advised organizations to consider taking unpatched PHP services offline entirely .

The **EU's CERT-EU** issued a warning urging immediate patching, and said that if patching wasn't possible, websites should be taken offline .

Even the underground felt the heat. The forum **PwnForums** went down for what a Telegram channel described as "PHP bug maintenance." The darknet forum **Dread** and **Kiwi Farms** were also reportedly affected .

### The Exploitation Rush

Cloudflare deployed WAF protections **nine hours ahead of public disclosure**, and by October 22, the company reported that exploit attempts had reached **millions** .

Sophos and Arctic Wolf reported attempts to exploit the vulnerabilities to install a **Mirai botnet variant** — though those attempts had not succeeded as of the latest reporting .

KELA Cyber assessed with **moderate confidence** that no successful compromise attributable to these CVEs had been established yet. But the firm warned that the barrier to reliable exploitation is likely to fall as researchers analyze the patches .

---

## The New Flaw: CVE-2026-115560

Now let's talk about the second advisory that landed on Friday.

### The Specific Conditions

CVE-2026-115560 is a **potential remote code execution** vulnerability, but it requires a very specific — and rare — configuration.

According to PHP's advisory, an application is only exposed if **all three** of the following conditions are met :

**First**, the application's configuration sets `session.serialize_handler` to `php_binary` or `php_serialize`.

**Second**, the application's code changes that setting to `php` at runtime using `ini_set()` before calling `session_start()`.

**Third**, the `session.upload_progress` feature is enabled.

Only the third condition is common — `session.upload_progress` is enabled by default. But changing the session serialization format at runtime is extremely rare. PHP itself describes the scenario as **"improbable"** .

### The Good News

For most organizations, **this new flaw doesn't change anything**.

If you applied the PHP2Shell patches on October 21 and left them in place, you're likely already protected — because the mitigation PHP recommends for CVE-2026-115560 is the same one it recommended for PHP2Shell: disable `session.upload_progress.enabled` .

If you only updated PHP but didn't apply that mitigation, you should do it now. The fix is a one-line change in `php.ini`:

`session.upload_progress.enabled=0`

Then restart every PHP worker process .

### The Bigger Picture

CVE-2026-115560 is a reminder that **PHP2Shell wasn't the end of the story**. The patches closed two critical doors. But the underlying complexity of PHP — and the ways applications configure it — creates ongoing risk.

Researcher **Andrew Dorman** separately reported session-handling flaws that he claims survive in PHP 8.5.12, including object injection and conditional remote code execution under specific configurations. Those findings haven't been confirmed by PHP or independently verified .

The lesson: **Patching is necessary. But it's not sufficient.** Configuration matters. And for anyone running PHP, the work of securing it is never finished.

---

## What This Means for American Businesses and Website Owners

Let me bring this down to earth. What should you actually do?

### If You Run a Website

**First, check your PHP version.** If you're on PHP 8.2, 8.3, 8.4, or 8.5, you need to be on the patched releases: **8.2.35, 8.3.36, 8.4.27, or 8.5.12** .

**Second, restart your web server.** Installing the patched package doesn't load the patched runtime into running processes. You need to restart Apache, PHP-FPM, and every long-running PHP worker .

**Third, apply the upload progress mitigation.** Even after patching, set `session.upload_progress.enabled=0` in `php.ini` or your PHP-FPM pool configuration — not via `ini_set()` or `.user.ini`, which apply too late .

**Fourth, check your secrets.** If your server was exposed before patching, rotate any credentials that the PHP process could read — database passwords, API keys, session tokens .

### If You Use a Hosting Provider

**Ask them what version of PHP they're running.** If they can't tell you, or if they're running an end-of-life version, consider moving.

Most shared hosting providers manage PHP for you. But you should confirm that they've applied the October 21 patches and restarted their workers.

### If You Run WordPress or Another PHP Application

**The application code isn't the problem.** PHP2Shell and CVE-2026-115560 are flaws in the PHP runtime, not in WordPress or any plugin. Updating your plugins won't fix this. Only updating PHP will .

---

## Frequently Asked Questions (FAQs)

### Q1: What is PHP2Shell?

PHP2Shell is the nickname for two critical vulnerabilities in PHP — **CVE-2026-109618** and **CVE-2026-109619** — that allow unauthenticated remote code execution. They were patched on October 21, 2026. Both were rated CVSS 9.2 out of 10 .

### Q2: What is CVE-2026-115560?

CVE-2026-115560 is a **new, unpatched** remote code execution vulnerability disclosed on October 23, 2026. It requires a rare configuration: an application must change `session.serialize_handler` from `php_binary` or `php_serialize` to `php` at runtime while `session.upload_progress` is enabled. PHP describes the scenario as "improbable" .

### Q3: Do I need to worry about CVE-2026-115560 if I patched PHP2Shell?

**Probably not.** If you applied the PHP2Shell patches and disabled `session.upload_progress.enabled`, you're likely already protected against CVE-2026-115560, because the mitigation is the same .

### Q4: How do I fix PHP2Shell?

Update to **PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35**, then **restart your web server and PHP workers**. Also set `session.upload_progress.enabled=0` as a defense-in-depth measure .

### Q5: Is my website at risk if I use WordPress?

**Yes, if you're running an outdated PHP version.** The vulnerabilities are in PHP itself, not WordPress. Updating WordPress plugins won't fix it. You need to update PHP .

### Q6: What if I'm on shared hosting?

Ask your hosting provider what PHP version they're running and whether they've applied the October 21 patches. If they can't confirm, consider moving to a provider that can .

### Q7: What is PHP 8.2 end of life?

PHP 8.2 reaches **end of life on December 31, 2026**. After that date, it will receive no further security fixes. If you're on PHP 8.2, you should upgrade to 8.3 or later before the end of the year .

### Q8: How many servers are affected?

VirusTotal identified approximately **5.1 million IP addresses running PHP**. About **four in five** of those that disclosed their version were running an end-of-life branch that wouldn't receive an official patch .

---

## High-Value Keywords for Content Creators and AdSense Publishers

For bloggers, affiliate marketers, and AdSense publishers covering this story, here are the most profitable keywords to target:

### Tier 1: High CPC ($15+)

| Keyword | Estimated CPC | Search Volume |

|---------|--------------|---------------|

| Best web hosting for WordPress 2026 | $25-$40 | Very High |

| Best managed WordPress hosting | $20-$35 | Very High |

| How to update PHP version | $18-$30 | High |

| Best website security tools 2026 | $15-$25 | High |

| WordPress security plugin | $15-$22 | Very High |

### Tier 2: High Volume, Low Competition

| Keyword | Search Volume | Competition |

|---------|--------------|-------------|

| PHP2Shell vulnerability explained | Very High | Low |

| CVE-2026-115560 explained | High | Very Low |

| How to fix PHP2Shell | High | Low |

| Is my website vulnerable to PHP2Shell | High | Low |

| PHP 8.2 end of life upgrade guide | High | Low |

### Tier 3: Long-Tail Money Keywords

- "How to check my PHP version for PHP2Shell"

- "Best hosting providers that patched PHP2Shell"

- "What is session.upload_progress and why disable it"

- "PHP2Shell vs CVE-2026-115560 difference"

- "How to secure WordPress after PHP vulnerability"

---

## Conclusion: A Week That Exposed the Internet's Fragility

The PHP2Shell crisis and the immediate follow-up with CVE-2026-115560 tell a story about the modern internet that most Americans never see.

**The good news:** The PHP security team moved fast. Cloudflare deployed protections before the patches even went live. Governments and CERTs issued warnings. The ecosystem responded.

**The bad news:** The internet runs on software that is **fragile, complex, and often outdated**. Millions of servers are running end-of-life PHP versions that will never receive official patches. And the disclosure of one critical flaw often invites scrutiny that uncovers more.

For American businesses and website owners, the message is clear: **Patching is not optional.** It's not something you do when you get around to it. It's a fundamental security practice, as essential as locking your front door.

For American consumers, the message is simpler: **The websites you use every day depend on software you've never heard of.** And when that software has a flaw, the consequences can be enormous.

PHP powers 70% of the web. It just had one of its worst weeks in years. And the work of securing it is far from over.

---

## Disclaimer

This article is for informational and educational purposes only and does not constitute financial, technology, or security advice. The information contained herein is based on publicly available sources as of October 23, 2026. Software vulnerabilities and patches are subject to rapid change. The author and publisher are not responsible for any decisions made based on the information presented in this article. Always consult official PHP documentation and security advisories for the most current information.

---

**Tags**: #PHP #PHP2Shell #CVE2026109618 #CVE2026109619 #CVE2026115560 #CyberSecurity #WebSecurity #RCE #Vulnerability #PatchManagement #WordPress #WebHosting #TechNews #SecurityNews #PHP8 #Cloudflare #CISA #CERT #OpenAI #Wiz #Calif #AmericanBusinesses #WebsiteSecurity #TechAnalysis #DataProtection #InfoSec #CyberAttack #ZeroDay #SecurityPatch #WordPressSecurity #WebDev