PHP Warns of Separate Unpatched RCE Path and Recommends Disabling Upload Progress
PHP warned on October 23 of a separate way attackers could potentially run code on a web server. The issue, CVE-2026-115560, affects only web applications using an unusual configuration and is not covered by the emergency PHP2Shell fixes released two days earlier. PHP recommends disabling session upload progress until a routine release provides a fix.
The exposure requires several conditions to occur together. An application must configure session serialization as php_binary or php_serialize, change that setting at runtime to php with ini_set(), and make the change before calling session_start(). Session upload progress must also remain enabled. Applications that do not change the serialization handler while running are not exposed through this path, according to PHP.
For affected deployments, the immediate measure is to set session.upload_progress.enabled=0. This is the same mitigation PHP listed for CVE-2026-109619, one of the two earlier PHP2Shell vulnerabilities. Administrators who already applied that setting and left it enabled do not need an additional change for CVE-2026-115560.
The new issue should not be confused with the earlier PHP2Shell flaws. Those vulnerabilities were fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but those releases do not fix CVE-2026-115560. Reports of exploitation since October 21 concern the two earlier flaws, not the newly disclosed issue.
PHP has not yet identified the affected versions, the releases that will contain the fix, or a severity score. It also says the configuration is unlikely in practice and is handling the issue through the regular release cycle rather than issuing another emergency update. A full advisory is expected with the next release.