anik.
23 October 2026 · PHP2Shell · CVE-2026-115560 · Unpatched RCE Risk

PHP Warns of Another Unpatched RCE Risk

By Md Anik Biswas · Rajshahi, Bangladesh

PHP Warns of Another Unpatched RCE Risk

PHP Warns of New Code Execution Risk After Emergency PHP2Shell Patches

PHP has warned of another potential way for attackers to execute code on a web server, just two days after releasing emergency patches for the critical PHP2Shell vulnerabilities.

The newly disclosed issue, tracked as CVE-2026-115560, affects web applications using an unusual session configuration. PHP considers the risk unlikely in practice and is not releasing an emergency patch. Instead, it recommends disabling session upload progress until a fix becomes available in a routine release.

What Is CVE-2026-115560?

PHP published an informational security advisory on October 23, 2026. The warning follows the October 21 emergency release that addressed two critical PHP2Shell vulnerabilities:

  • CVE-2026-109618
  • CVE-2026-109619

Those vulnerabilities could allow unauthenticated attackers to execute code on affected servers. They were patched in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

However, CVE-2026-115560 is a separate issue and is not fixed by those releases.

Which PHP Applications Are at Risk?

According to PHP's advisory, the vulnerability requires a specific combination of configuration settings and application behavior.

An application may be exposed if it meets all the following conditions:

  • It configures session.serialize_handler as php_binary or php_serialize.
  • It changes the serialization handler to php at runtime using ini_set().
  • It makes that change before calling session_start().
  • Session upload progress remains enabled.

This combination is unusual, which is why PHP considers the vulnerability unlikely to affect typical deployments.

Applications that do not change their session serialization handler at runtime are not exposed through this specific attack path simply because session upload progress is enabled.

How to Mitigate the Vulnerability

PHP recommends disabling session upload progress until a fix becomes available in the next routine bugfix release.

Add the following setting to your PHP configuration:

session.upload_progress.enabled = 0

Depending on your hosting environment, you may need to apply this setting through php.ini or another supported PHP configuration mechanism.

After changing the configuration, verify that the setting is effective in the PHP environment running your application.

Already Applied the Mitigation?

If you disabled session upload progress following the October 21 advisory for CVE-2026-109619 and have kept the setting in place, no additional action is required for this newly disclosed issue.

Session upload progress is enabled by default in PHP and allows applications to track the progress of file uploads.

What Developers Should Do Next

PHP developers and server administrators should review their session configuration and check whether their applications modify session.serialize_handler at runtime.

Recommended actions include:

  • Disable session.upload_progress.enabled until an appropriate fix becomes available.
  • Review application code for calls to ini_set() that modify session serialization settings.
  • Keep PHP installations updated when new security releases become available.
  • Verify the effective PHP configuration in production rather than relying solely on local development settings.
  • Monitor official PHP security advisories for further updates.

Final Thoughts

CVE-2026-115560 highlights the importance of reviewing PHP session configuration even after applying recent security updates. Although PHP considers the affected configuration uncommon, disabling session upload progress is a straightforward precaution.

Administrators should apply the recommended mitigation and monitor official PHP security advisories for the next routine bugfix release.

← All posts