URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP has warned of another critical remote code execution vulnerability just two days after emergency patches were released for PHP2Shell flaws.
PHP has identified another way attackers could execute code on web servers, following closely on the heels of emergency fixes for critical PHP2Shell vulnerabilities. The newly discovered issue, assigned CVE-2026-115560, is considered unlikely to affect most systems due to its specific configuration requirements.
Specific Configuration Required
The vulnerability only affects web applications that meet all of these conditions: setting the session.serialize_handler option to php_binary or php_serialize, then changing it to php using ini_set() before calling session_start(), while keeping session upload progress enabled. PHP states this setup is uncommon in practice.
Recommended Action
PHP is not issuing an emergency fix but recommends setting session.upload_progress.enabled=0 as a temporary mitigation. This single-line configuration change disables the feature that tracks file upload progress. Anyone who applied this mitigation for the previous vulnerabilities already has protection in place.
The action is one line. PHP recommends setting session.upload_progress.enabled=0 until the next routine bugfix release.
Future Plans
The fix will be included in PHP's next routine release, though the project hasn't specified which versions will be patched or a severity score for CVE-2026-115560. No exploitation of this new vulnerability has been reported, with attacks since October 21 targeting only the earlier PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619).
Related
