PHP warns of unpatched RCE in rare session setup (CVE-2026-115560)
Original title: URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
Only apps that switch the session serialize handler at runtime and leave upload progress on are exposed; no attacks on this bug are reported.
On October 23, PHP published an informational advisory for CVE-2026-115560, a separate remote code execution issue two days after emergency PHP2Shell fixes. PHP says the bug needs an uncommon configuration and is not issuing an emergency patch. It advises setting session.upload_progress.enabled=0 until the next routine bugfix release. PHP has not named affected versions, a fix release, or a severity score. Attacks reported since October 21 target the earlier PHP2Shell flaws, not this CVE.
Unconfirmed: PHP has not stated affected versions, fixed releases, a severity score, or whether this shares a root cause with CVE-2026-109619.
- The October 21 fixes cover CVE-2026-109618 and CVE-2026-109619 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- Those releases do not fix CVE-2026-115560.
- Risk requires php_binary or php_serialize, then ini_set() to php before session_start(), with upload progress on.
- Apps that never change the serialize handler at runtime are not exposed on this path.
- Anyone who already set session.upload_progress.enabled=0 for CVE-2026-109619 needs nothing more.
Impact: Remote code execution on unusually configured PHP web apps
| Product | Affected |
|---|---|
| PHP | — |
- 1.Set session.upload_progress.enabled=0 until the next routine bugfix release.
- CVEs
- CVE-2026-115560
- Vendors
- PHP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115560 | — | — | PoC ×8 | — |
From the original article
2 min read at thehackernews.com
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The project is not issuing an emergency fix for it.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.