More than 5.1 million PHP hosts are exposed online, and roughly 3.8 million have at least one port open to attacks, according to VirusTotal estimates — a scale that makes even narrow, configuration-dependent flaws worth watching.
CVE-2026-115560: an unpatched RCE tied to an unusual configuration
The PHP security team disclosed mitigation steps for a new remote code execution (RCE) flaw tracked as CVE-2026-115560 and said there is currently no patch. The flaw, the team explained, "can only be exploited when targeting systems with an unusual combination of configuration and application code." In the team’s words: "An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled."
Because the exploit requires that specific sequence, the developers are treating the issue in the normal release cycle and plan to publish a full advisory with the next release. Until a security patch is available, the PHP team recommended setting session.upload_progress.enabled=0 and added, "If you applied it then, keep it in place and no further action is needed."
PHP2Shell (CVE-2026-109618, CVE-2026-109619): patches, leaks, and pre-release activity
Separately, PHP patched two critical RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 — collectively referred to as PHP2Shell — after urging administrators to prepare to install updates as soon as they were released. The PHP security team said some proof-of-concept (PoC) code was published before the patches went live but that none of those PoCs were functional.
Multiple cybersecurity companies — including Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack — nonetheless detected unsuccessful exploitation attempts before the public disclosure, an activity the PHP team linked to leaked details. The leak, the team said, included the CVE IDs and mitigation advice that had been provided to some critical infrastructure providers.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleEvidence of reconnaissance and early attacks: Amazon and Dataminr findings
Security researchers at Amazon Threat Intelligence reported that attackers began targeting the PHP2Shell flaws four days before the patches were released. AWS chief information security officer CJ Moses said: "The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors. Technical analysis is ongoing, and it's unclear if any of these attempts would have succeeded in real-world systems." He added that "PHP2Shell is now seeing broad exploitation attempts in the wild," while noting there is no clarity on how many attacks, if any, succeeded.
Dataminr’s Threat Research and Cyber Engineering (TRACE) team observed activity consistent with early-stage abuse: "observed activity since vulnerability disclosure remains limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises," but warned that "it remains only a matter of time for working POCs or successful exploitation activity to emerge."
Scale and defensive posture: why a configuration-only exploit still matters
PHP is used by nearly 70% of all websites on the Internet, the security team noted, and the population of exposed hosts is large enough that even unusual configurations will exist in meaningful numbers. The PHP team emphasized that systems that never change the serialize handler at runtime can keep session upload progress enabled; the risk applies only to hosts that combine runtime handler switches with enabled upload progress.
The contrast between broad exposure and narrow exploitability also shows up in defensive measurements. The Blue Report 2026 observed that "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The report measures defenses technique by technique across 338 million simulations run in customer production environments, underscoring that post-compromise behaviour can degrade defenses even where perimeter controls look strong.
What this means for technologists, affected enterprises, and policymakers
- Technologists and security teams: Check application code and configurations for any use of session.serialize_handler that switches at runtime and verify whether session.upload_progress.enabled is set. If the mitigation has already been applied — "keep it in place and no further action is needed," per the PHP team — and prepare to install the full advisory and any future patches when the next release is published.
- Affected enterprises and procurement leaders: Inventory externally exposed PHP hosts (VirusTotal’s counting of more than 5.1 million hosts and 3.8 million with open ports is a reminder of scale) and prioritize systems that run non-default session handling. Be ready to apply PHP’s forthcoming advisory and any security updates quickly.
- Policymakers and infrastructure custodians: Note that mitigation advice and CVE details were shared with some critical infrastructure providers prior to public disclosure; leak-driven pre-release scanning and exploitation attempts reported by multiple vendors and by Amazon Threat Intelligence indicate disclosure-management and information-sharing processes will materially affect which actors can begin scanning before patches land.
For now, the immediate, practical step is narrow: disable session upload progress where the risky runtime handler switch could occur and keep that change until PHP’s full advisory and patches arrive. Beyond that, multiple vendors and researchers have documented reconnaissance and failed exploits; whether functional PoCs or successful compromises follow remains an open, time-sensitive question.
