PHP urges workaround for unpatched RCE CVE-2026-115560
Original title: PHP Publishes Mitigation Advice for New RCE Flaw
The bug needs a rare runtime switch of the session serialize handler and will not be fixed until the next release.
On October 23 the PHP security team warned of remote code execution CVE-2026-115560 and said it will not be patched until the next release because most sites will not meet the conditions. Exploitation requires session.serialize_handler set to php_binary or php_serialize, then switched to php with ini_set() before session_start(), with session upload progress still enabled. Admins are told to keep session.upload_progress.enabled=0, the mitigation already advised on October 21 for CVE-2026-109619. Apps that never change the serialize handler at runtime can leave the feature on.
Unconfirmed: It remains unclear how an unknown actor obtained details to attempt PHP2Shell exploitation before official publication.
- PHP says the issue affects a relatively small share of installations.
- The October 21 setting is enough if it is already applied.
- Last week's maximum-severity pair is CVE-2026-109618 and CVE-2026-109619.
- Amazon said an unknown actor tried those bugs four days before publication.
- How that actor obtained pre-disclosure details is still unclear.
Impact: Remote code execution under a rare PHP session configuration
| Product | Affected |
|---|---|
| PHP | unpatched; unusual session serialize-handler configuration |
- 1.Set session.upload_progress.enabled=0 and keep that setting until the next bugfix release.
- 2.Leave upload progress enabled only if the app never changes the serialize handler at runtime.
- CVEs
- CVE-2026-115560
- Vendors
- PHP
- Organizations
- Amazon Web Services
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115560 | — | — | PoC ×11 | — |
From the original article
2 min read at infosecurity-magazine.com
PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.