PHP has disclosed another potential remote code execution vulnerability only two days after releasing emergency security updates for the critical PHP2Shell flaws. The newly identified issue, tracked as CVE 2026 115560, could allow code execution on a web server under a specific and uncommon application configuration. According to the PHP development team, the issue presents a limited risk because it only affects web applications that follow a particular sequence of configuration changes during runtime. Rather than issuing another emergency security update, the project has advised developers and administrators to temporarily disable the session upload progress feature until a permanent fix becomes available in the next scheduled maintenance release. The advisory was published on October 23 and clarifies that the newly disclosed issue is separate from the PHP2Shell vulnerabilities addressed earlier in the week.
The latest advisory follows the emergency release issued on October 21, when PHP published security updates to address the critical PHP2Shell vulnerabilities tracked as CVE 2026 109618 and CVE 2026 109619. Those flaws allowed unauthenticated attackers to execute code on vulnerable servers and were resolved in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP emphasized that the recently disclosed CVE 2026 115560 is not fixed by those releases because it originates from a different code path. According to the project, the vulnerability only becomes possible when an application initially configures the session.serialize_handler option as php_binary or php_serialize, changes it to php using the ini_set() function before calling session_start(), and leaves the session upload progress feature enabled. Applications that never modify the serialization handler during execution are not exposed through this scenario, making the affected configuration relatively uncommon in production environments.
As an immediate precaution, PHP recommends disabling the session upload progress feature by setting session.upload_progress.enabled to zero until the next routine bug fix release becomes available. This recommendation matches the temporary mitigation previously provided during the October 21 advisory for CVE 2026 109619, meaning organizations that already implemented that configuration change remain protected from the newly disclosed issue without requiring additional action. PHP noted that session upload progress is enabled by default and is commonly used by applications to monitor the status of file uploads. Despite identifying the issue, the project has not yet confirmed which PHP versions are affected, which future releases will contain the permanent fix, or the official severity rating assigned to the vulnerability. It has also not disclosed whether the issue shares any technical relationship with the earlier PHP2Shell flaws.
At present, PHP stated that there are no reports of CVE 2026 115560 being actively exploited in real world attacks. However, security activity surrounding the previously disclosed PHP2Shell vulnerabilities has increased significantly since their public disclosure. Amazon reported that its honeypot systems detected exploitation attempts targeting CVE 2026 109618 and CVE 2026 109619 on October 17, several days before the vulnerabilities were publicly announced. Cloudflare also observed exploitation attempts increasing rapidly from tens of thousands shortly after disclosure to millions within hours. Researchers from Sophos and Arctic Wolf reported that attackers attempted to use the earlier vulnerabilities to deploy a Mirai botnet variant, although available findings from Previdian, Wordfence and other security organizations indicate that these activities have largely consisted of scanning and probing rather than confirmed successful code execution. Security researchers also noted that developing a reliable exploit for the earlier PHP2Shell vulnerabilities has proven more difficult than initially anticipated, while no attack activity has been reported against CVE 2026 115560 so far.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
