PHP warns of unlikely code-execution flaw CVE-2026-115560
Original title: PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches
Disable session upload progress until a routine release; the October 21 PHP2Shell patches do not fix it, and no attacks are reported.
On October 23, PHP warned of CVE-2026-115560, a code-execution issue separate from PHP2Shell. It requires session.serialize_handler set to php_binary or php_serialize, then switched to php with ini_set() before session_start(), while session upload progress stays enabled. PHP calls that setup unlikely and will fix it in the regular release cycle. No attacks on this issue are reported. October 21 updates for CVE-2026-109618 and CVE-2026-109619 do not cover it.
Unconfirmed: PHP has not said whether CVE-2026-115560 shares a root cause with CVE-2026-109619.
- The temporary mitigation is session.upload_progress.enabled=0.
- Apps that never change the serialize handler at runtime are not exposed this way.
- PHP has not named affected versions, a severity score, or a fix date.
- PHP2Shell patches are 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
- Cloudflare saw millions of attempts against those earlier bugs by October 22.
Impact: Code execution under an unusual session-handler configuration
| Product | Affected |
|---|---|
| PHP | — |
- 1.Set session.upload_progress.enabled=0 until the next routine bugfix release.
- 2.If that setting is already in place from the October 21 advisory, no further action is required for this issue.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115560 | — | — | PoC ×8 | — |
From the original article
2 min read at securityaffairs.comPHP warns of a new, unlikely code execution flaw, CVE-2026-115560, and advises disabling session upload progress until a fix is released. PHP has warned of a new code execution vulnerability, tracked as CVE-2026-115560, just two days after releasing emergency patches for the critical PHP2Shell flaws. In an advisory published on October 23, the project recommended […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.