CVE-2026-115560: PHP warned on October 23 that a separate, as-yet-unpatched path could allow remote code execution in narrowly configured web applications — two days after emergency fixes for the closely watched PHP2Shell flaws.
PHP's October 23 advisory and its posture
In a short informational advisory published October 23, PHP described a new vulnerability assigned CVE-2026-115560 and said it is handling the issue through its routine release cycle rather than issuing an emergency fix. The project called the risk unlikely because it requires a narrow and uncommon application setup. PHP said it will publish a full advisory for CVE-2026-115560 with the next regular release.
PHP also stated that it has not disclosed which versions are affected, which specific releases will include the fix, nor a severity score. The project did not say whether CVE-2026-115560 shares a root cause with the two PHP2Shell flaws patched on October 21.
Exactly how an application can be exposed
According to PHP, the vulnerability arises only when a web application does all of the following steps in sequence: it sets the session.serialize_handler option to php_binary or php_serialize in its configuration; it then changes that option to php while running by calling ini_set(); and it makes that change before it calls session_start(). Session upload progress must also still be enabled. PHP emphasized that an application that never changes the serialize handler while running can leave session upload progress on and is not exposed through this path.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildMitigation: turn off session upload progress
PHP's recommended mitigation is one line: set session.upload_progress.enabled=0 until the routine bugfix release ships a permanent fix. That is the same configuration change the project listed as a mitigation in its October 21 advisory for CVE-2026-109619. Because the one-line mitigation was already published two days earlier, PHP noted that anyone who applied it then and left it in place needs to do nothing more for the new issue.
PHP also reminded readers that session upload progress is turned on by default and is used to let an application track the progress of a file upload.
How this fits with the October 21 PHP2Shell emergency patches
On October 21 PHP released emergency fixes for two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, which the project said could allow an unauthenticated attacker to run code on a server. Those two flaws were patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP made clear that CVE-2026-115560 is separate and is not fixed by those October 21 releases.
Observed exploitation and attacker activity tied to the October 21 flaws
PHP's new advisory arrives amid rapid exploitation activity tied to the earlier PHP2Shell flaws. Amazon said its honeypots logged an exploit attempt against CVE-2026-109618 and CVE-2026-109619 on October 17, four days before those flaws were disclosed. Cloudflare reported that attempts to exploit the October 21 disclosures rose from tens of thousands within 45 minutes of the public disclosure to millions by early October 22.
Threat reporting companies Sophos and Arctic Wolf said attackers have attempted to use the two earlier PHP2Shell flaws to install a Mirai botnet variant. Those vendors, along with Previdian, Wordfence and other researchers, have reported scanning and probing activity but — so far — no confirmed successful code execution from those campaigns; researchers noted that a reliable exploit has proved harder to build than expected. The activity described by those groups targets CVE-2026-109618 and CVE-2026-109619, not CVE-2026-115560, and PHP said no exploitation of CVE-2026-115560 has been reported.
What this means for security teams, site operators, and attackers
- Security teams and site operators: Confirm whether session.upload_progress.enabled was set to 0 after the October 21 advisory; if not, PHP recommends setting session.upload_progress.enabled=0 as an immediate mitigation for CVE-2026-115560. Operators should also verify whether their applications change session.serialize_handler at runtime and, if so, understand that this specific code path is listed by PHP as the condition that creates exposure.
- Affected enterprises and procurement leaders: Systems running PHP versions patched on October 21 (8.5.12, 8.4.27, 8.3.36, 8.2.35) have fixes for CVE-2026-109618 and CVE-2026-109619, but those patches do not address CVE-2026-115560; enterprises should track PHP's next routine release for the permanent fix and apply it when available.
- Attackers and malware operators: Current exploitation efforts and scanning activity have focused on the two October 21 flaws; PHP reports no observed exploitation of CVE-2026-115560 so far, and the project characterized the new issue as unlikely in practice because of the narrow configuration required.
Two days after an emergency response to the most urgent PHP2Shell flaws, PHP has pointed administrators to a simple but specific setting that mitigates a separate, narrow path to code execution. The advisory leaves several technical details — affected versions, release timing, and a severity score — for the next routine release, and it places immediate emphasis on a one-line configuration change already recommended two days earlier.
