PHP Warns of New Remote Code Execution Flaw, Offers Mitigation Advice

“PHP is used in around 70% of global websites,” and that footprint helps explain why even a flaw the maintainers call narrowly exploitable draws urgent attention: the PHP security team published an advisory on October 23 warning of a new remote code execution vulnerability tracked as CVE-2026-115560, while urging administrators to keep an earlier mitigation in place until the project issues a bugfix release.

PHP security team: CVE-2026-115560 occurs only under a narrow, specific configuration

In its October 23 advisory, the PHP security team said CVE-2026-115560 will not be patched until the next release because “the issue can only occur under an unusual combination of configuration and application code.” The advisory specifies the technical prerequisites: an application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). The advisory adds that “Session upload progress must also still be enabled.”

PHP security team: retain the October 21 mitigation for full protection

The maintainers referenced a mitigation they recommended in an October 21 advisory for CVE-2026-109619 (one of two maximum severity zero-day flaws published last week). “We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector,” the October 23 notice said. It added: “If you applied it [last week], keep it in place and no further action is needed.”

System administrators and security teams: coordination and exhaustion after P2PShell

Administrators and security teams are still recovering from last week’s rush to remediate two maximum severity zero days—CVE-2026-109618 and CVE-2026-109619—collectively known as “P2PShell.” Those incidents produced widespread website outages as teams scrambled to apply patches and mitigations.

Mike Lyborg, CISO at Swimlane, warned that the response to CVE-2026-115560 will require “a precise response” after the disruption caused by P2PShell. “Keeping services running through successive warnings takes coordination that holds up after everyone’s exhausted,” he said. “Across organizations responding to PHP last week, the next bottleneck could be a handoff between the people assessing risk and those authorized to change a live service.”

Enterprises running WordPress, Drupal, Joomla and Magento: a major global endeavor

Because PHP “is used in around 70% of global websites,” and because that ecosystem includes widely deployed content management systems such as WordPress, Drupal, Joomla and Magento, the work to patch P2PShell and to maintain mitigations for CVE-2026-115560 remains a major global endeavor. The October advisories frame the immediate task as keeping session upload progress disabled until PHP ships a bugfix release that addresses the narrow exploit path.

Adversaries and cloud providers: pre-publication activity and disclosure questions

The advisory cycle for last week’s P2PShell flaws was complicated by an accidental pre-release disclosure of technical details a day before patches were due. Amazon Web Services subsequently revealed that an unknown threat actor tried to exploit the bugs four days before they were officially published. “It remains unclear how they managed to get hold of the information needed to attempt such an attack,” the reporting noted.

Taken together, the maintainers’ assessment that CVE-2026-115560 is unlikely to be widely exploitable sits beside a recent pattern of high-impact zero days, an accidental early disclosure, and at least one pre-publication exploitation attempt. For now the record is concrete: the PHP team will include a fix in the next bugfix release, and administrators who enabled the October 21 mitigation are told to keep session.upload_progress disabled until that release arrives.

Original story — Infosecurity Magazine