PHP shares mitigation for unpatched RCE CVE-2026-115560
Original title: PHP shares mitigation for new RCE vulnerability with no patch
Only unusual session-handler setups are affected; admins should keep session.upload_progress.enabled set to 0 until the next release.
The PHP security team published mitigations for CVE-2026-115560, a remote code execution flaw with no patch that applies only when an application switches the session serialize handler at runtime and session upload progress stays enabled. PHP said a full advisory will come with the next regular release. The same note follows patches for PHP2Shell, CVE-2026-109618 and CVE-2026-109619, which several firms say are now drawing scanning and non-working exploit attempts.
Unconfirmed: It is unconfirmed whether any PHP2Shell exploitation attempts succeeded on real systems.
- Exploitation requires php_binary or php_serialize, then a runtime switch to php before session_start().
- Mitigation is session.upload_progress.enabled=0; apps that never change the handler can leave the feature on.
- PHP2Shell was patched Wednesday after earlier non-functional proof-of-concept code.
- Amazon said multiple actors probed PHP2Shell four days before patches; success is unclear.
- Dataminr reported only scanning, fingerprinting and non-working exploits, with no known compromises.
Impact: Remote code execution on unusual PHP session configurations
| Product | Affected |
|---|---|
| PHP | non-default session serialize handler setups |
- 1.Set session.upload_progress.enabled=0 and keep that setting until PHP ships a patch.
- Products
- PHP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 | |
| CVE-2026-115560 | — | — | PoC ×8 | — |
From the original article
2 min read at bleepingcomputer.com
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.