PHP warned on October 23, 2026, of another unpatched remote code execution issue, tracked as CVE-2026-115560, two days after the project released emergency fixes for the critical PHP2Shell flaws. The PHP project’s security team said the newly warned issue requires a specific configuration, considers the risk unlikely, and is not issuing an emergency patch, with a correction planned for the next routine release.
Key Points
- PHP issued an informational warning about CVE-2026-115560, a newly assigned potential code execution issue.
- The issue applies only when applications use a specific session configuration and change it at runtime before starting a session.
- PHP recommends disabling session upload progress until a routine bugfix release is available.
- Administrators who already disabled session upload progress for the earlier PHP2Shell mitigation do not need additional action for this issue.
- No exploitation of CVE-2026-115560 had been reported, while observed activity after October 21 targeted the earlier PHP2Shell flaws.
What PHP warned about
The October 23 informational advisory was issued by the PHP project’s security team and concerns CVE-2026-115560. The advisory described another way attackers could potentially execute code on a web server under limited conditions.
The warning followed PHP’s emergency release for the earlier critical PHP2Shell vulnerabilities by two days. PHP had already listed disabling session upload progress as a mitigation for the earlier PHP2Shell issue, and the same setting is now recommended for CVE-2026-115560.
Who is exposed
PHP said the issue requires the application to set session.serialize_handler to php_binary or php_serialize, then change it at runtime to php using ini_set(). That change must occur before the application calls session_start().
The described attack path also requires session.upload_progress to remain enabled. Applications that do not change the serialize handler at runtime are not exposed through this path, according to PHP.
Session upload progress is enabled by default and allows applications to track the progress of file uploads. PHP recommends setting session.upload_progress.enabled=0 until the routine bugfix release is available.
Patch status and activity
PHP said administrators who had already disabled session upload progress as a mitigation for the earlier issue do not need to take additional action for CVE-2026-115560. PHP had not yet stated which versions are affected, which releases will contain the fix, or what severity score will be assigned to the vulnerability.
No exploitation of CVE-2026-115560 had been reported. Attack activity observed after October 21 was directed at the two earlier PHP2Shell flaws rather than the newly warned issue.
The current mitigation is to disable session upload progress where possible and review applications that change PHP session serialization settings at runtime before calling session_start(). PHP’s planned fix is expected in a routine bugfix release rather than an emergency update.
About the Author
