PHP Flags a New RCE Flaw (CVE-2026-115560): Keep the Same Setting Used Against PHP2Shell

Did you disable Session Upload Progress to protect yourself from PHP2Shell flaws? Keep that setting in place. The PHP team is warning about a new code-execution vector, CVE-2026-115560, and it uses the same function. Here’s what you need to know.

As a reminder, on October 21, 2026, the PHP team urgently released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix PHP2Shell, two critical flaws (CVE-2026-109618 and CVE-2026-109619) that allowed unauthenticated remote code execution. I published an article about those fixes, and since then we learned that Amazon spotted exploitation attempts four days before the patches were released.

Two days later, on October 23, PHP published a notice about a new security issue tracked as CVE-2026-115560. On paper, it is another remote code execution (RCE) flaw without a patch. In practice, I would not panic: the PHP team itself describes it as an unlikely code-execution vector and will not release an emergency version. That does not rule out a future security fix.

This issue is distinct from PHP2Shell. As a result, the October 21 releases do not fix it, since PHP is referring users to the next maintenance update. The only thing PHP2Shell and this new flaw have in common is that the mitigation is the same as one of the temporary workarounds already recommended for CVE-2026-109619.

CVE-2026-115560: three conditions must align

According to the PHP team, the issue can only occur with an unusual combination of PHP configuration and application code. That immediately limits the chances of exploitation for this new vulnerability. All of the conditions below must be met:

• PHP configuration: the session.serialize_handler directive is set to php_binary or php_serialize.
• Application code: the application changes that directive back to php at runtime using ini_set(), before calling session_start().
• Session Upload Progress: the feature is still enabled, which is the default.

The first point already rules out the default configuration, since session.serialize_handler defaults to php. In addition, an application that never changes this handler at runtime can keep Session Upload Progress enabled without being exposed through this path. In other words, it requires an unusual configuration and an application behaving in a very specific way.

"Because this configuration is unlikely in practice, we are handling it in the normal release cycle and will publish a full advisory for CVE-2026-115560 with the next release," the PHP team said. That is a far cry from the pressure they put on everyone ahead of the patches for the PHP2Shell flaws.

At this stage, several details are still missing: PHP has not provided the list of affected versions, the version that will include the fix, or a CVSS score.

What you should do, and what you should not do

PHP’s recommendation for protecting against this flaw, and this is where we come back to one of the mitigations you already know, is to set session.upload_progress.enabled to 0. If you already did that after PHP2Shell, there is nothing else to do, as long as you keep that setting in place.

• The right place: as stated in the GHSA-6wmf-4rv5-p3rp advisory dedicated to CVE-2026-109619, the directive must be set in php.ini, in the PHP-FPM pool, or in the server configuration, and then each worker must be restarted. Do not rely on ini_set() or a .user.ini file.
• Check your code: searching your application code for session.serialize_handler (a recursive grep is enough) will quickly tell you whether this scenario applies to you.
• The side effect: this feature is used to track file upload progress, usually to display a progress bar. Any application relying on it will lose that display.

There is also an important note about this Session Upload Progress feature: "It may be prudent to set session.upload_progress.enabled to 0 if you do not need this feature, even after applying the fix, because more and more attackers are looking for vulnerabilities in this little-used and little-tested feature."

You can head into the weekend with peace of mind!

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio