PHP has warned developers about a newly identified remote code execution (RCE) risk, CVE-2026-115560, just two days after releasing emergency patches for two critical PHP2Shell vulnerabilities.
The issue affects only a narrow set of web applications with an unusual session configuration. PHP considers exploitation unlikely and is not issuing an emergency patch, instead recommending that administrators disable session upload progress until a fix arrives in a routine release.
In an informational advisory published on October 23, PHP explained that the vulnerability can affect applications configured to use a non-default session.serialize_handler value, such as php_binary or php_serialize, before changing it to php at runtime using ini_set(). The change must occur before the application calls session_start(), and session upload progress must remain enabled for the attack path to apply.
Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc
— The PHP Foundation (@ThePHPF) October 23, 2026
PHP recommends setting session.upload_progress.enabled=0 as a temporary mitigation. Administrators who already disabled this feature following Wednesday’s advisory for CVE-2026-109619 do not need to take additional action for the newly reported issue. Session upload progress is enabled by default and allows applications to track the progress of file uploads.
The new vulnerability is separate from the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, which received emergency fixes on October 21 in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Those vulnerabilities can allow unauthenticated attackers to execute code on affected servers. The emergency patches do not address CVE-2026-115560.
PHP has not yet specified the affected versions, the releases that will contain the new fix, or a severity score. A full advisory is expected alongside the next routine release. There have also been no reported attacks exploiting CVE-2026-115560.
Meanwhile, exploitation attempts targeting the earlier PHP2Shell vulnerabilities have increased. Amazon reported that its honeypots detected exploit attempts before the flaws were publicly disclosed, while Cloudflare observed activity rising from tens of thousands of attempts to millions shortly after disclosure. Security researchers have also reported attempts to deploy a Mirai botnet variant, although confirmed successful code execution has not been established in the reported activity.
For administrators, the immediate step is straightforward: keep session.upload_progress.enabled disabled until PHP releases further guidance and a fix. Those who already applied the mitigation should leave it in place.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
