- PHP has disclosed CVE-2026-115560, a possible remote code execution flaw that affects apps with an unusual mix of session settings.
- The project advises turning off session upload progress until a permanent fix arrives in a routine release.
- No attacks on the new flaw have been reported, but attempts against two earlier PHP2Shell flaws keep growing.
PHP has warned users about another possible remote code execution (RCE) flaw. RCE means an attacker could run their own commands on a computer from far away. The warning came only two days after emergency updates for two critical PHP2Shell flaws. The new issue is tracked as CVE-2026-115560. It affects a small group of web apps and has no immediate patch.
The PHP project shared an informational advisory on October 23, 2026. It calls the risk unlikely. An attacker would need a very specific mix of app code and settings. So the team will not rush out another emergency release. It plans to fix the flaw in its next regular bugfix release.
A Rare Setup Opens the Door
According to the advisory, the flaw can appear when an app sets the session.serialize_handler directive to php_binary or php_serialize in its settings. The app then changes that value to php while it runs, using ini_set(), before it calls session_start(). A session is how a website remembers a visitor from one page to the next. The handler decides how that saved visitor data is packed for storage.
Session upload progress must also stay switched on for this attack path to exist. This feature tracks how far a file upload has gone. PHP enables it by default. Apps that never change their handler at runtime do not face this risk through the setup in the advisory. PHP says the needed setup is uncommon. That is why the team chose a routine fix.
The project suggests setting session.upload_progress.enabled=0 until the next regular bugfix release. PHP gave the same advice in its October 21 advisory for CVE-2026-109619. Admins who turned the feature off after that notice and kept it off need no extra steps.
PHP has not yet published a full technical advisory. That report will list the affected versions and the severity score. It will also name the releases that carry the permanent fix.
New Warning Follows Critical PHP2Shell Patches
PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21. Those updates fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619. A CVE is a public ID number for a known security flaw. Both flaws let attackers run code on vulnerable servers without logging in. PHP urged users to update right away.
The UK National Cyber Security Centre also took notice. So did the European Union Agency for Cybersecurity. Both told organisations to put the fixes first. The new CVE is separate from those two flaws. The October 21 updates do not solve it. PHP has not said whether CVE-2026-115560 shares a root cause with CVE-2026-109619.
Meanwhile, reports of attempted attacks on the earlier flaws have grown. Reports say Amazon’s honeypots recorded an attempted exploit on October 17, before the public disclosure. A honeypot is a decoy system that records attack attempts. Cloudflare also reported a sharp rise in exploit attempts after the October 21 disclosure.
Security researchers have seen attempts to use the earlier flaws to install a Mirai botnet variant. A botnet is a group of hacked devices that one attacker controls. Still, the reports describe scanning and probing. They do not confirm that any attempt ran code successfully. All of these reports concern CVE-2026-109618 and CVE-2026-109619, not the new flaw.
Steps Admins Can Take for Now
PHP admins should review their session settings and switch off session upload progress as advised. They should also watch official PHP announcements for the permanent fix. These two steps cost little and protect systems that might be affected.
A similar patching challenge has affected Windows 11, where Microsoft acknowledged that its October updates failed to fix an Always On VPN bug.
No reported attacks do not mean admins can ignore the flaw. Still, the current evidence does not show active exploitation of CVE-2026-115560. It also does not show the same wide risk as the two earlier PHP2Shell flaws. PHP says it will publish a full advisory with the next release. Until then, the settings change remains the main precaution for exposed systems.
Share this article
About the Author
Farwa is an experienced InfoSec writer and cybersecurity journalist skilled in writing articles related to cybersecurity, AI, DevOps, Big Data, Cloud security, VPNs, IAM, and Cloud Computing. Also a contributor on Tripwire.com, Infosecurity Magazine, Security Boulevard, DevOps.com, and CPO Magazine.
More from Farwa SajjadRelated Posts
Google and Other Tech Giants Block eMudhra Certificates After Weak Keys Exposed
Researchers cracked eight very weak secret keys tied to Indian certificate company eMudhra within se...
Microsoft Admits Windows 11 October Updates Failed to Fix Always On VPN Bug
Microsoft says its October 2026 Windows 11 updates did not fix the Always On VPN connection bug. The...
Canva Confirms Salesforce Data Exposure via Canny as Hackers Claim Millions of Records
Canva says hackers got into Canny, a tool it used for product feedback, and accessed some business c...
Phonelyne Faces Unverified Data Leak Claim Involving eSIM Codes and API Keys
A hacker called DaOnlySpark claims to hold customer, payment, and eSIM records tied to Phonelyne. Th...
BeyondTrust Remote Support Zero-Day Exploited by China-Linked Hackers
Google and Mandiant say a suspected China-linked group, Armory Castle, used the flaw before the publ...
GitHub Replaces Stargazer Scraping With Privacy-Focused Star History API
GitHub’s new API shows how a repository’s stars grow over time without revealing who sta...
