PHP warns of another security flaw
What's the story
PHP has flagged a new security vulnerability, CVE-2026-115560, that could allow an attacker to execute code on a web server. The issue only affects web applications with specific configurations and is considered an unlikely risk by PHP. The organization is not issuing an emergency fix for it but recommends disabling the session upload progress feature until the next routine release.
Advisory details
New warning issued after emergency release on October 21
The warning was issued in a brief informational advisory published today.
This comes after an emergency release on October 21, which fixed two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities allowed an unauthenticated attacker to run code on a server.
The issues were patched in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 respectively, but the new issue remains unaddressed by those releases as it is different from the earlier ones.
Risk assessment
PHP clarifies that only a narrow setup is at risk
PHP has clarified that only a narrow setup is at risk from this new vulnerability.
It can occur when a web application sets the session.serialize_handler option to php_binary or php_serialize in its configuration, then changes that option to php while running by calling ini_set(), and makes that change before calling session_start().
The feature must also still be turned on for an application that never changes the serialize handler while running can leave it on and isn't exposed through this path.
Attack surge
Exploitation attempts against PHP2Shell flaws have spiked recently
Meanwhile, exploitation attempts on the two earlier PHP2Shell flaws have surged.
Amazon logged an exploit attempt against CVE-2026-109618 and CVE-2026-109619 on October 17, four days before the flaws were disclosed.
Cloudflare also reported a spike in attempts from tens of thousands within 45 minutes of the October 21 disclosure to millions by early October 22.