"Requires a very unlikely combination of configuration and specific PHP application code, which we do not expect to occur in practical use of PHP," Elizabeth Barron, executive director of the PHP Foundation, told The Register on Friday.
CVE-2026-115560: a reserved ID, not an emergency patch
The PHP Foundation has reserved CVE-2026-115560 for a third remotely executable code (RCE) flaw related to the PHP2Shell incident, but it will not be pushed out as an emergency hotfix. Instead, the Foundation says it will publish a full advisory and ship a correction in the next regular PHP release. The Foundation has published an informational advisory on its website and described the issue as mitigable by configuration.
Exactly how the third bug could be triggered
The Foundation's advisory explains the precise, narrow chain of conditions that would be required. An application must set session.serialize_handler to either php_binary or php_serialize in its configuration and then switch that setting to php at runtime via ini_set() before calling session_start(). In addition, the session upload progress feature must be enabled. Because this particular sequence must all be present, the Foundation judges the vector "unlikely in real-world applications" and advises a configuration mitigation for those who want immediate protection: set session.upload_progress.enabled=0 until the next regular bugfix release.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogHow this relates to the earlier PHP2Shell flaws
The two vulnerabilities that forced the initial emergency response — CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell — involved memory-safety flaws in PHP. The PHP Foundation officially disclosed and patched those two bugs on Wednesday. The Foundation and other groups have tied the urgency of the earlier fixes to the scale of PHP's deployment: PHP runs on about 70 percent of websites with a known server-side programming language, according to the report.
Researchers, proof-of-concepts, and exploitation status
Researchers and defenders have publicly documented exploitation attempts against the earlier PHP2Shell bugs, and multiple proof-of-concept (PoC) exploits circulated both before and after the CVE disclosures. Despite those reports, the Foundation said it has "no evidence of successful exploitation of the two vulnerabilities from Wednesday prior to disclosure, and we currently have no evidence of any exploitation of these vulnerabilities on patched PHP versions." The Foundation added that it "received no further indication from OpenAI, Wiz or Calif, with whom we're working closely on this issue, regarding any issues on patched systems."
Security vendors and researchers contacted by The Register reported they have documented exploitation attempts but not confirmed successful compromises. Mandiant Chief Technology Officer Charles Carmakal wrote on LinkedIn that "exploitation may have already begun in a limited fashion and the threat is viable and very serious." Carmakal also noted that many publicly circulating PoCs "appear to be 'vibe-coded' and are incapable of remote code execution," although he said his team validated some PoCs that achieved RCE against default deployments of mod_php but not against PHP-FPM.
What this means for technologists, enterprises, and adversaries
- Technologists and security teams: Check whether any applications in your environment change session.serialize_handler at runtime or rely on the session upload progress feature; as a short-term mitigation the Foundation recommends setting session.upload_progress.enabled=0. Expect the Foundation to include the definitive fix in the next scheduled bugfix release rather than an out-of-cycle remediation.
- Affected enterprises and procurement leaders: The rapid disclosure and patching of CVE-2026-109618 and CVE-2026-109619, and the Foundation's decision to treat CVE-2026-115560 as informational pending a regular release, mean inventories and patch plans should prioritize already-patched releases and track the next regular PHP update for the third fix.
- Adversaries and threat actors: Public PoCs are circulating and some have been validated for RCE in specific configurations (default mod_php deployments). That mix of public tooling and configuration-dependent success underscores why defenders must both patch and verify deployment settings.
The PHP Foundation's position is pragmatic: a reserved CVE and an informational advisory for a bug the maintainers judge improbable in practice, with a configuration knob available now and a code fix coming on the normal release cadence. The broader episode — two patched memory-safety flaws that prompted emergency action and a third, narrow vector that will be handled in the regular cycle — leaves defenders balancing immediate mitigations against the practical constraints of emergency rollouts and configuration drift. The record, as the Foundation and multiple researchers describe it, shows documented attempts and live PoCs but no publicly confirmed, widespread successful compromises as of Friday.