NEWS

PHP Warns of Another Unpatched RCE Risk (CVE-2026-115560) Two Days After Emergency PHP2Shell Patches

PHP flagged CVE-2026-115560, a code-execution risk tied to session handlers, two days after its PHP2Shell fixes. No emergency patch; disable upload progress.

Dylan H.

News Desk

October 24, 2026
2 min read
PHP Warns of Another Unpatched RCE Risk (CVE-2026-115560) Two Days After Emergency PHP2Shell Patches

Overview

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, CVE-2026-115560, was announced in a PHP advisory on October 23, 2026. It is not addressed by the earlier fixes.

PHP considers it an "unlikely risk" because it affects only applications configured in an unusual way. No emergency fix is planned: it will be handled in the next routine release, with a full advisory published then.

Background: PHP2Shell

On October 21, 2026, PHP shipped an emergency release for CVE-2026-109618 and CVE-2026-109619, two critical flaws that let an attacker without an account run code on a server. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Conditions for CVE-2026-115560

All of the following must be true:

  1. The application sets session.serialize_handler to php_binary or php_serialize in its configuration.
  2. It changes that option to php at runtime using ini_set().
  3. It makes that change before calling session_start().
  4. Session upload progress is still enabled (it is on by default).

Applications that never change the serialize handler at runtime are not exposed through this path.

What Is Not Yet Known

PHP has not disclosed the affected versions, fixed versions, a severity score, or whether the issue shares a root cause with CVE-2026-109619.

Exploitation Activity

No exploitation of CVE-2026-115560 has been reported. For the earlier PHP2Shell flaws:

  • Amazon's honeypots logged an exploit attempt on October 17, four days before disclosure.
  • Cloudflare reported attempts rising from tens of thousands within 45 minutes of disclosure to millions by early October 22.
  • Sophos and Arctic Wolf reported attempts to install a Mirai botnet variant. These have not yet achieved confirmed code execution, and researchers say a reliable exploit is harder to build than expected.

Mitigation

  1. Apply the October 21 PHP2Shell fixes (8.5.12, 8.4.27, 8.3.36, 8.2.35) if you have not.
  2. Set session.upload_progress.enabled=0 until the next routine bugfix release. This is the same mitigation PHP listed for CVE-2026-109619, so anyone who applied it needs no further action.
  3. Search code for runtime ini_set('session.serialize_handler', ...) calls made before session_start().
  4. Monitor web logs for unusual multipart upload requests carrying session upload progress fields.

Sources