PHP Warns of Another Unpatched Remote Code Execution Risk Days After PHP2Shell Emergency Updates
The PHP development team has issued a new security warning about a potential remote code execution vulnerability, just two days after releasing emergency patches for the critical PHP2Shell flaws. The newly disclosed issue, tracked as CVE-2026-115560, affects applications using an uncommon combination of session configuration settings and remains unpatched as of October 25, 2026.
Unlike the earlier PHP2Shell vulnerabilities, which prompted urgent security updates across the PHP ecosystem, the latest issue is considered unlikely to affect typical deployments. PHP maintainers have decided to address it through the regular release cycle rather than publish another emergency update.
Nevertheless, the advisory highlights the complexity of securing a programming language that powers millions of web applications. Even after critical vulnerabilities have been patched, unusual runtime configurations can introduce additional security risks that require administrators to review their environments carefully.
The PHP team recommends temporarily disabling the session upload progress feature in affected applications until a permanent fix becomes available. The mitigation involves a single configuration change, but understanding whether it is necessary requires examining how an application initializes and manages PHP sessions. <Cite refs={["turn999385view0","turn225607view0"]}/>
CVE-2026-115560 Affects an Unusual Session Configuration
The newly identified vulnerability involves PHP's session handling functionality, specifically the interaction between session serialization settings and the session upload progress mechanism.
PHP sessions allow web applications to maintain information between HTTP requests, supporting features such as user authentication, shopping carts, and personalized experiences. Session serialization determines how that information is converted into a format that can be stored and subsequently restored.
PHP supports several serialization handlers, includingphp,php_binary, andphp_serialize. Applications normally select a handler through their configuration and continue using it consistently throughout execution.
According to the October 23 advisory, the potential remote code execution condition arises only when an application uses a specific sequence of configuration changes.
The application must initially configuresession.serialize_handleras eitherphp_binaryorphp_serialize. It must then switch the handler tophpduring execution using theini_set()function, before callingsession_start().
The session upload progress feature must also remain enabled for the vulnerable condition to occur.
This combination is unusual because most applications do not dynamically change their session serialization handler during execution. As a result, PHP maintainers believe that relatively few real-world applications are likely to meet all the conditions required for exploitation.
Importantly, applications that never change their serialization handler at runtime are not exposed through this particular attack path, even when session upload progress remains enabled.
The PHP project has not yet published a detailed technical explanation of the vulnerability or established whether it shares an underlying cause with the earlier PHP2Shell flaws. It has also not announced a CVSS severity score or a definitive list of affected PHP versions.<Cite ref="turn225607view0"/>
A New Warning Following the PHP2Shell Emergency
The disclosure comes immediately after one of the most significant PHP security events of 2026.
On October 21, the PHP development team released emergency updates addressing two critical vulnerabilities:CVE-2026-109618 and CVE-2026-109619. Both could potentially allow unauthenticated attackers to execute code on vulnerable web servers.
The vulnerabilities involved memory corruption and improper handling of internal runtime state. In certain configurations, malicious requests could trigger dangerous behavior before normal application code began executing, limiting the effectiveness of security controls implemented within web frameworks.
The emergency updates were released as PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The project urged administrators to deploy the corrected versions immediately, particularly because internet-facing PHP installations represented attractive targets for exploitation.
However,those emergency releases do not fix CVE-2026-115560. The latest issue is being tracked separately and will be addressed in an upcoming routine bugfix release.
The distinction is important for administrators who have already completed their PHP2Shell remediation. Updating to the October 21 versions protects against the two previously disclosed vulnerabilities, but it does not automatically eliminate the newly identified session configuration risk.
PHP's latest advisory also notes that disabling session upload progress was already recommended as a temporary mitigation for one of the earlier vulnerabilities, CVE-2026-109619.
Organizations that applied this measure during the emergency response and have kept it enabled do not need to make an additional configuration change for CVE-2026-115560.
Exploitation Attempts Continue Against Earlier PHP Vulnerabilities
While no exploitation of CVE-2026-115560 has been publicly reported, security researchers continue to observe substantial activity targeting the two earlier PHP2Shell vulnerabilities.
Amazon reported detecting an attempted exploitation of the earlier flaws on October 17, four days before their public disclosure. The observation raised concerns that some attackers may have possessed technical information before the coordinated security announcement.
Following the October 21 disclosure, scanning and exploitation attempts increased rapidly. Cloudflare reported that malicious requests grew from tens of thousands shortly after the announcement to millions by the following day.
Researchers also observed attempts to use the vulnerabilities to deploy malware associated with the Mirai botnet, which is commonly used to compromise internet-connected devices and assemble distributed denial-of-service infrastructure.
However, the distinction between attempted exploitation and confirmed compromise remains essential. Several security companies reported scanning and probing activity without identifying successful remote code execution in the environments they monitored.
Researchers also noted that developing reliable exploits for the memory corruption flaws appeared more difficult than initially anticipated.
These observations do not reduce the importance of applying security updates. Even unsuccessful exploitation attempts demonstrate that attackers are actively investigating the weaknesses and attempting to identify vulnerable systems.
They also reinforce why the new advisory should be evaluated separately. The reported exploitation campaigns target CVE-2026-109618 and CVE-2026-109619, not the newly disclosed CVE-2026-115560.<Cite ref="turn999385view0"/>
How Administrators Can Reduce Exposure
PHP maintainers recommend a straightforward temporary mitigation for applications that may be affected by CVE-2026-115560.
Administrators can disable session upload progress by setting the following option in the PHP configuration:
session.upload_progress.enabled=0This setting prevents PHP from using the session upload progress mechanism associated with the newly identified attack path.
The feature is enabled by default and allows applications to monitor the progress of file uploads through session data. Disabling it may affect applications that explicitly depend on this functionality, so administrators should evaluate the operational impact before changing production configurations.
The most important step is determining whether an application uses the unusual serialization sequence described in the advisory. Developers should inspect configuration files and application code for changes tosession.serialize_handler, particularly calls toini_set()that occur before session initialization.
Applications that consistently use the same serialization handler do not require the new mitigation solely because of CVE-2026-115560.
Organizations should also ensure that their PHP installations have received the October 21 emergency security updates. The newly announced issue does not replace or reduce the urgency of addressing the earlier critical vulnerabilities.
For larger environments, the review should extend to container images, managed hosting configurations, and applications that override PHP settings dynamically. Different services may use different session configurations even when they share the same PHP runtime version.
Once PHP publishes the permanent correction, administrators should deploy the updated packages through their normal software maintenance processes and verify whether temporary mitigations remain necessary.
Why the Latest PHP Advisory Matters
The new vulnerability illustrates an important aspect of software security: critical weaknesses do not always affect every deployment equally.
The earlier PHP2Shell flaws presented broad risks across internet-facing PHP installations, prompting emergency updates and extensive defensive monitoring. CVE-2026-115560, by contrast, depends on an uncommon application configuration and has not been reported under active exploitation.
Treating both situations identically could lead organizations to misallocate resources. Effective vulnerability management requires understanding not only the potential consequences of a flaw, but also the conditions necessary for exploitation.
The PHP project's decision to handle the latest issue through its regular release cycle reflects that distinction. Rather than issuing another emergency update, maintainers have provided a targeted mitigation while preparing a permanent correction.
The incident also highlights the importance of reviewing application behavior alongside software versions. Security teams often focus on identifying outdated dependencies, but configuration choices and runtime interactions can determine whether a particular vulnerability is reachable.
For PHP administrators, the immediate priorities are clear: maintain the emergency PHP2Shell patches, review session serialization behavior, and disable session upload progress where the newly identified risk applies.
CVE-2026-115560 is not another confirmed widespread PHP exploitation crisis. It is a narrowly conditioned, currently unpatched security issue that demonstrates why careful configuration management remains essential even after major vulnerabilities have been addressed.