Science & Tech · Cybersecurity · 51 mins ago
PHP warns of a third, unlikely code execution flaw
The PHP project has warned of a third code execution flaw, tracked as CVE-2026-115560, days after emergency fixes for two PHP2Shell vulnerabilities.
PHP is widely used to build websites, and this new issue could let an attacker run code on a server.
The risk applies only when an application uses an unusual combination of session settings and still has upload progress tracking enabled.
PHP says this setup is unlikely in real-world use, so it is not issuing an emergency patch.
Administrators should turn off session upload progress until the fix is included in a routine release.
Those who already disabled the feature for the earlier PHP2Shell issue do not need to take further action for this flaw.
PHP has not yet named the affected versions or specified when the fix will arrive, and no attacks on this new flaw have been reported.
PHP has warned of a third remote code execution flaw, tracked as CVE-2026-115560, but says the conditions needed to exploit it are unlikely in practice.
The flaw affects applications that change a session serialization setting at runtime before starting a session while session upload progress is enabled.
PHP recommends disabling session upload progress until the flaw is fixed in a regular release.
The flaw is separate from the two PHP2Shell vulnerabilities patched on October 21, and those patches do not fix it.
No attacks targeting CVE-2026-115560 have been reported.
- Who
- The PHP project warned about the flaw. KISA also advised server administrators in South Korea to take temporary measures.
- What
- A newly identified vulnerability, CVE-2026-115560, could allow remote code execution under a specific configuration.
- When
- PHP published an informational advisory on October 23, 2026.
- Where
- It affects PHP web applications using the specified configuration; no specific location is stated.
- Why
- A combination of session settings and application behavior can create a code execution path.
This story does not have two clearly opposing sides.
PHP released emergency patches for the two PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
PHP published an informational advisory for CVE-2026-115560 and recommended disabling session upload progress until a regular release fixes the flaw.
KISA issued a notice urging administrators to apply the temporary measure and keep the feature disabled until a patch is released.
- New flaw
- CVE-2026-115560
- Temporary mitigation
- Set session.upload_progress.enabled=0
- Required setting
- Change session.serialize_handler from php_binary or php_serialize to php at runtime before calling session_start()
- Additional condition
- Session upload progress must be enabled
- Planned fix
- A regular PHP release; the release date and affected versions were not stated
4 sources
What people are saying
The issue can be mitigated with a configuration setting.
We have no evidence of successful exploitation of the two vulnerabilities from Wednesday prior to disclosure, and we currently have no evidence of any exploitation of these vulnerabilities on patched PHP versions.
Keep it disabled until the official security patch is released and continue monitoring for signs of cyber intrusion.