Third PHP2Shell bug waits for the regular PHP release
Original title: There's a third PHP2Shell bug, but it won't get an emergency fix
CVE-2026-115560 needs a rare session setup; the foundation reports no confirmed compromises of the two bugs patched Wednesday.
The PHP Foundation reserved CVE-2026-115560 for a third remote-code-execution issue tied to PHP2Shell and said it will ship a full advisory and fix in the next regular release, not an emergency update. The issue needs session.upload_progress enabled plus an unusual switch of session.serialize_handler before session_start(). Foundation director Elizabeth Barron said there is no evidence of successful exploitation of Wednesday's CVE-2026-109618 and CVE-2026-109619 before disclosure or on patched versions, while researchers have validated some public proofs of concept.
Unconfirmed: Carmakal says limited exploitation may have begun, while the PHP Foundation reports no evidence of successful exploitation.
- Users are told to set session.upload_progress.enabled=0 until the next bugfix release.
- The rare path uses php_binary or php_serialize, then switches to php with ini_set().
- Barron said OpenAI, Wiz and Calif reported no issues on patched systems.
- Mandiant CTO Charles Carmakal said limited exploitation may already have begun.
- Some validated PoCs achieve RCE on default mod_php but not PHP-FPM.
Impact: Remote code execution on websites under a rare configuration
| Product | Affected | Fixed in |
|---|---|---|
| PHP | — | next regular PHP release |
- 1.Set session.upload_progress.enabled=0 until the next regular bugfix release.
- Products
- PHP
- Organizations
- PHP FoundationMandiantWizOpenAI
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 | |
| CVE-2026-115560 | — | — | PoC ×8 | — |
From the original article
2 min read at theregister.comAs the PHP2Shell chaos continues, researchers have found a third PHP vulnerability that could allow attackers to take over websites or remotely run malware on vulnerable systems. But this one won’t receive an emergency fix.
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.