PHP Warns of Another Unpatched Remote Code Execution Vulnerability Following Critical PHP2Shell Updates

The PHP development team has disclosed another security vulnerability that could potentially allow remote code execution (RCE) in certain web application configurations, just two days after releasing emergency patches for the critical PHP2Shell vulnerabilities.

The newly identified flaw, tracked as CVE-2026-115560, affects applications using a specific combination of PHP session serialization settings.

Although the vulnerability remains unpatched, PHP maintainers consider exploitation unlikely because it requires an uncommon application configuration.

What Is CVE-2026-115560?

The vulnerability involves PHP's session handling functionality and may introduce a remote code execution risk when an application changes its session serialization configuration during execution.

For an application to be exposed, the following conditions must exist:

• The application initially configures session.serialize_handler as php_binary or php_serialize.
• The application changes the serialization handler to php using ini_set().
• The configuration change occurs before calling session_start().
• PHP's session upload progress feature remains enabled.

According to PHP maintainers, this configuration is unusual and unlikely to appear in most production environments.

Applications that do not dynamically change their session serialization handler are not affected through this specific exploitation path.

No Emergency Patch Released

Unlike the previous PHP2Shell vulnerabilities, the PHP development team has decided not to issue an emergency security update for CVE-2026-115560.

Instead, the vulnerability is expected to be addressed in the next regular PHP maintenance release.

As of the October 23 disclosure, PHP had not announced a CVSS severity score, a definitive list of affected versions or specific fixed releases.

There have also been no publicly reported exploitation attempts targeting this newly disclosed vulnerability.

PHP Recommends Immediate Mitigation

Until an official patch becomes available, administrators managing potentially affected applications are advised to disable PHP's session upload progress functionality.

The recommended configuration change is:

session.upload_progress.enabled = 0

This setting disables the feature used to track file upload progress through PHP sessions.

Organizations that already applied this mitigation following the earlier PHP2Shell security advisory do not need to repeat the change, provided it remains active.

Administrators should assess whether their applications depend on this functionality before modifying production configurations.

Earlier PHP2Shell Vulnerabilities Remain a Major Concern

The latest disclosure follows emergency security updates released on October 21, 2026, addressing two critical PHP vulnerabilities:

The earlier vulnerabilities could allow unauthenticated attackers to execute malicious code on vulnerable PHP web servers.

PHP released the following fixed versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

However, these updates do not resolve CVE-2026-115560.

Millions of PHP Exploitation Attempts Observed

Following the disclosure of the original PHP2Shell vulnerabilities, security companies reported a sharp increase in automated exploitation attempts.

Cloudflare observed attack activity escalating from tens of thousands of requests shortly after disclosure to millions by October 22.

Researchers also identified attempts to distribute a Mirai-based malware variant through vulnerable PHP environments.

However, these attacks targeted CVE-2026-109618 and CVE-2026-109619, not the newly disclosed CVE-2026-115560.

Researchers investigating the initial campaigns had not confirmed successful remote code execution through those attempts.

Security Recommendations

Organizations operating PHP-based applications should prioritize the following measures:

1. Review PHP configurations: Identify applications dynamically modifying session.serialize_handler.
2. Disable session upload progress where appropriate: Apply session.upload_progress.enabled = 0 as a temporary mitigation for the new vulnerability.
3. Apply existing security updates: Upgrade PHP installations to versions addressing the earlier PHP2Shell vulnerabilities.
4. Monitor security advisories: Track official PHP announcements for the upcoming CVE-2026-115560 fix.
5. Strengthen web server monitoring: Investigate suspicious requests, unauthorized command execution and unexpected application behavior.
6. Review application dependencies: Assess whether third-party frameworks or custom code modify PHP session settings.

Security Takeaway

The discovery of CVE-2026-115560 highlights the importance of reviewing application configurations alongside routine vulnerability patching.

Although the newly disclosed vulnerability has a narrow exploitation scope and no reported active exploitation, organizations using affected session-handling configurations should implement the recommended mitigation.

The earlier PHP2Shell vulnerabilities remain the more immediate security concern, making prompt patching and continuous monitoring essential for PHP-based web environments.