NEWS

PHP Shares Mitigation for New Unpatched RCE Flaw (CVE-2026-115560)

PHP disclosed another RCE, CVE-2026-115560, in session handling that has no patch yet. Disabling session upload progress mitigates it.

Dylan H.

News Desk

October 23, 2026
2 min read
PHP Shares Mitigation for New Unpatched RCE Flaw (CVE-2026-115560)

Overview

The PHP security team has published a mitigation for a new remote code execution vulnerability, CVE-2026-115560, that currently has no patch. It arrives two days after emergency fixes for the critical PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619).

The new bug is separate. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix PHP2Shell, do not fix it.

Who Is Affected

PHP says exploitation requires "an unusual combination of configuration and application code":

  1. session.serialize_handler is set to php_binary or php_serialize in the configuration.
  2. The application then switches it to php at runtime with ini_set() before calling session_start().
  3. Session upload progress is still enabled.

Applications that never change the serialize handler at runtime are not exposed through this path.

Mitigation

Set the following until a fix ships:

session.upload_progress.enabled = 0

This is the same setting PHP recommended in its October 21 advisory for CVE-2026-109619, so anyone who already applied it needs to do nothing more.

Patch Timeline

PHP considers the setup unlikely in practice and will not issue an emergency release. The flaw will be handled in the regular release cycle, with a full advisory published alongside the next release. Affected versions, fixed versions and a severity score have not yet been published.

Recommendations

  • Apply the session.upload_progress.enabled = 0 mitigation across PHP-FPM, Apache and CLI configurations.
  • Search application code for ini_set('session.serialize_handler' calls before session_start().
  • Make sure PHP2Shell patches are applied; that flaw is under active exploitation and has no complete mitigation other than updating.
  • Watch the PHP security advisories for the follow-up release.

Sources