PHP has disclosed another potential remote code execution (RCE) vulnerability, just two days after releasing emergency security updates for the critical PHP2Shell flaws.
Tracked as CVE-2026-115560, the newly reported issue affects a narrow range of web application configurations. PHP considers the scenario unlikely to occur in practice and is not releasing an emergency patch. Instead, the project recommends disabling the affected session upload progress feature until a fix becomes available in a future routine release.
The informational advisory was published on October 23, 2026, following the October 21 emergency releases that addressed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Those flaws could allow unauthenticated attackers to execute code on vulnerable servers.
The earlier vulnerabilities were patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, CVE-2026-115560 is a separate issue and is not fixed by those releases.
Which PHP Configurations Are Vulnerable?
According to PHP, the newly disclosed vulnerability can occur only when an application uses a specific combination of session serialization settings and runtime configuration changes.
The application must meet all of the following conditions:
- Set the
session.serialize_handlerconfiguration option to eitherphp_binaryorphp_serialize. - Change the option to
phpat runtime usingini_set(). - Make this configuration change before calling
session_start(). - Leave session upload progress enabled.
This combination creates the conditions under which the vulnerability may be triggered.
Applications that do not change the session serialization handler at runtime are not exposed through this particular attack path, even if session upload progress remains enabled.
PHP described the required configuration as unlikely to be encountered in practice, which is why the project is addressing the issue through its regular release cycle rather than issuing an emergency update.
PHP Recommends Disabling Session Upload Progress
Until a permanent fix becomes available, PHP recommends disabling session upload progress by setting the following configuration directive:
session.upload_progress.enabled=0
This feature is enabled by default and allows applications to track the progress of file uploads.
Disabling it provides a temporary mitigation for the newly disclosed issue and was also recommended in PHP’s October 21 advisory addressing CVE-2026-109619.
Administrators who already applied this mitigation and have left it enabled do not need to take additional action for CVE-2026-115560.
The setting can generally be applied through the relevant PHP configuration, subject to the hosting environment and its configuration-management requirements. Administrators should verify that the change has taken effect in the PHP environment serving their web applications.
No Emergency Patch Planned for CVE-2026-115560
PHP plans to address the vulnerability in a forthcoming routine bugfix release and publish a more detailed security advisory at that time.
As of the October 23 announcement, the project had not specified the affected PHP versions, the exact releases that would contain the fix, or a severity score for CVE-2026-115560.
It also had not confirmed whether the underlying cause is related to CVE-2026-109619.
No exploitation of CVE-2026-115560 had been reported at the time of disclosure. The exploitation activity observed since October 21 has instead focused on the two earlier PHP2Shell vulnerabilities.
PHP2Shell Exploitation Attempts Continue to Increase
The new advisory comes amid growing exploitation attempts targeting CVE-2026-109618 and CVE-2026-109619.
Amazon reported that its honeypots recorded an exploitation attempt against the two vulnerabilities on October 17, four days before their public disclosure on October 21.
Cloudflare also reported a sharp increase in attack activity following the disclosure. Exploitation attempts rose from tens of thousands within the first 45 minutes to millions by early October 22, 2026.
Security researchers have observed attempts to exploit the original PHP2Shell flaws to deploy a Mirai-based botnet variant. However, these efforts have so far failed to produce confirmed successful compromises in the reported investigations.
Previdian, Wordfence, and other security teams have documented scanning, probing, and exploitation attempts but reported no confirmed code execution in their observations.
Researchers believe reliable exploitation of the original PHP2Shell vulnerabilities is proving more difficult than initially anticipated.
Importantly, these reports concern CVE-2026-109618 and CVE-2026-109619, which were patched on October 21. They do not indicate that CVE-2026-115560 is being actively exploited.
What PHP Administrators Should Do
Organizations operating PHP-based websites should take the following steps to reduce potential exposure:
- Disable session upload progress: Set
session.upload_progress.enabled=0as a temporary mitigation. - Review session configuration: Check whether applications change
session.serialize_handlertophpthroughini_set()before callingsession_start(). - Install the earlier security updates: Ensure that PHP is running a patched version addressing CVE-2026-109618 and CVE-2026-109619.
- Monitor upcoming releases: Review PHP’s official security advisories and apply the permanent fix when it becomes available.
- Investigate suspicious activity: Continue monitoring for exploitation attempts associated with the earlier PHP2Shell vulnerabilities.
Conclusion
CVE-2026-115560 introduces another security consideration for PHP administrators shortly after the emergency PHP2Shell fixes. Although the newly disclosed issue requires an uncommon application configuration and no exploitation has been reported, it could create an additional risk for systems that meet the affected conditions.
For now, PHP recommends disabling session upload progress until a permanent fix is released. Administrators should also ensure that the earlier PHP2Shell vulnerabilities have been addressed and avoid confusing exploitation reports involving those flaws with the newly disclosed issue.
