PHP warns of unpatched session RCE, CVE-2026-115560, with no emergency fix
First merged summary.
PHP disclosed CVE-2026-115560, an unpatched session RCE limited to rare setups, and advises disabling upload progress until a routine release.
On October 23, PHP published an informational advisory for CVE-2026-115560, a remote code execution issue separate from the PHP2Shell bugs patched two days earlier. PHP says the flaw applies only when an application uses php_binary or php_serialize, then switches the session serialize handler to php with ini_set() before session_start(), while session upload progress remains enabled. It is not issuing an emergency patch and has not named affected versions, a severity score, or a fix date. The advised mitigation is session.upload_progress.enabled=0 until the next regular bugfix release; apps that never change the handler are not exposed on this path. No attacks on CVE-2026-115560 are reported. Scanning and exploit activity described by outlets targets the October 21 PHP2Shell flaws, which these releases do not fix.
- CVE-2026-115560 has no emergency patch and no named affected versions or severity.
- Mitigation is session.upload_progress.enabled=0 until the next routine release.
- October 21 PHP2Shell fixes are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- Those releases cover CVE-2026-109618 and CVE-2026-109619, not CVE-2026-115560.
- Apps that already disabled upload progress for CVE-2026-109619 need nothing more.
- Cloudflare saw millions of attempts against the earlier bugs by October 22.
Timeline
dated events in the reporting · oldest first- Oct 21, 2026PHP ships emergency PHP2Shell patches for two RCEs · The Hacker News
- Oct 22, 2026Cloudflare reports millions of attempts against PHP2Shell · Security Affairs
- Oct 23, 2026PHP posts informational advisory for CVE-2026-115560 · oss-security
What each outlet adds
beyond the shared facts- The Hacker NewsNames the four patched PHP versions and says this CVE is unattacked.
- BleepingComputerAmazon probes before patches; Dataminr saw only non-working exploits.
- Security AffairsCloudflare counted millions of attempts against the earlier bugs.
- The RegisterBarron reports no confirmed compromises; Carmakal says limited exploitation may have begun.
- oss-securityForwards the PHP.net archive post without versions or impact.
Coverage
oldest first · one row per article · UTC- · 2d ago
The Hacker NewsFirst report
PHP warns of unpatched RCE in rare session setup (CVE-2026-115560)
Only apps that switch the session serialize handler at runtime and leave upload progress on are exposed; no attacks on this bug are reported.
- · 2d ago
BleepingComputer
PHP shares mitigation for unpatched RCE CVE-2026-115560
Only unusual session-handler setups are affected; admins should keep session.upload_progress.enabled set to 0 until the next release.
- · 2d ago
oss-security
PHP posts informational advisory on session upload progress
The oss-security note only links a PHP.net post and does not state impact, versions, or a fix.
- · 2d ago
Security Affairs
PHP warns of unlikely code-execution flaw CVE-2026-115560
Disable session upload progress until a routine release; the October 21 PHP2Shell patches do not fix it, and no attacks are reported.
- · 2d ago
The Register · Security
Third PHP2Shell bug waits for the regular PHP release
CVE-2026-115560 needs a rare session setup; the foundation reports no confirmed compromises of the two bugs patched Wednesday.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 | |
| CVE-2026-115560 | — | — | PoC ×8 | — |